Closed Bug 784015 Opened 7 years ago Closed 7 years ago

Crash [@ js::ParallelArrayObject::getParallelArrayElement] with Floating Point Exception (SIGFPE)

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla17
Tracking Status
firefox16 --- unaffected
firefox17 --- verified
firefox-esr10 --- unaffected

People

(Reporter: decoder, Assigned: shu)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase, Whiteboard: [jsbugmon:update][adv-track-main17-])

Crash Data

Attachments

(1 file)

The following test crashes on mozilla-central revision c676b554c7bb (no options required):


var p = new ParallelArray([1,25e8 ,3,4]);
var pp = p.partition(.34 );



Valgrind shows:

==56980== Process terminating with default action of signal 8 (SIGFPE)
==56980==  Integer divide by zero at address 0x701C37D
==56980==    at 0x8352743: js::ParallelArrayObject::partition(JSContext*, JS::CallArgs) (ParallelArray.cpp:1371)
==56980==    by 0x8191613: JS::CallNonGenericMethod(JSContext*, bool (*)(JS::Value const&), bool (*)(JSContext*, JS::CallArgs), JS::CallArgs) (jsapi.h:1570)
==56980==    by 0x8355754: int NonGenericMethod<&(js::ParallelArrayObject::partition(JSContext*, JS::CallArgs))>(JSContext*, unsigned int, JS::Value*) (ParallelArray.cpp:163)
==56980==    by 0x816DCD8: js::CallJSNative(JSContext*, int (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) (jscntxtinlines.h:389)
==56980==    by 0x817662B: js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) (jsinterp.cpp:351)
==56980==    by 0x818450B: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2423)
==56980==    by 0x8176249: js::RunScript(JSContext*, JSScript*, js::StackFrame*) (jsinterp.cpp:308)
==56980==    by 0x8177036: js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::ExecuteType, js::StackFrame*, JS::Value*) (jsinterp.cpp:492)
==56980==    by 0x8177288: js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) (jsinterp.cpp:530)
==56980==    by 0x809AB80: JS_ExecuteScript (jsapi.cpp:5673)
==56980==    by 0x8050913: Process(JSContext*, JSObject*, char const*, bool) (js.cpp:433)
==56980==    by 0x805C457: ProcessArgs(JSContext*, JSObject*, js::cli::OptionParser*) (js.cpp:4813)


Marking s-s till triaged properly.
Attached patch fix and testcaseSplinter Review
Attachment #653428 - Flags: review?(dmandelin)
Attachment #653428 - Flags: review?(dmandelin) → review+
https://hg.mozilla.org/mozilla-central/rev/be7d6ce3ee9b
Assignee: general → shu
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
Do we think ESR10 is affected by this bug, or is this a newer regression?
(In reply to Alex Keybl [:akeybl] from comment #5)
> Do we think ESR10 is affected by this bug, or is this a newer regression?

It's introduced by http://hg.mozilla.org/integration/mozilla-inbound/rev/ea2ad8970f3e which is pretty recent.
Whiteboard: [jsbugmon:update] → [jsbugmon:update][adv-track-main17-]
Blocks: 778559
Group: core-security
Keywords: regression
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.