Closed Bug 811694 Opened 10 years ago Closed 10 years ago

JM Crash [@ js::mjit::EnterMethodJIT] on Heap with TI disabled

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

VERIFIED FIXED
Tracking Status
firefox18 --- unaffected
firefox19 + fixed
firefox-esr10 --- unaffected
firefox-esr17 --- unaffected

People

(Reporter: decoder, Unassigned)

References

Details

(4 keywords, Whiteboard: [jsbugmon:][adv-main19-])

Crash Data

The following testcase crashes on mozilla-central revision 4e9567eeb09e (run with -m -a --no-ti):


evaluate('\
var ClassToMethodMap =  { Array: [ "indexOf", "lastIndexOf", "every" ]  };\
function testMethod(Class, className, method) {\
  try  {\
    (0, Class.prototype[method])();\
  }  catch (e)  {  }\
}\
for (var className in ClassToMethodMap) {\
  var Class = this[className];\
  var methodNames = ClassToMethodMap[className];\
  for (var i = 0, sz = methodNames.length; i < sz; i++)   {\
    var method = methodNames[i];\
    testMethod(Class, className, method);\
  }\
}\
', { newContext: false, compileAndGo: true, global: newGlobal('new-compartment') });
Crash traces:


Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7fedb7d in ?? ()
(gdb) bt
#0  0x00007ffff7fedb7d in ?? ()
#1  0x00007ffff7fe8cd2 in ?? ()
#2  0x0000000000000001 in ?? ()
#3  0x00007fffffffd3e0 in ?? ()
#4  0x0000000000000000 in ?? ()
(gdb) x /i $pc
=> 0x7ffff7fedb7d:      mov    0x58(%r15),%r15


==44076== Invalid read of size 8
==44076==    at 0x402BB65: ???
==44076==    by 0x7AACC1: js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, JS::Value*, bool) (MethodJIT.cpp:1043)
==44076==    by 0x7AAF73: CheckStackAndEnterMethodJIT(JSContext*, js::StackFrame*, void*, bool) (MethodJIT.cpp:1101)
==44076==    by 0x7AB106: js::mjit::JaegerShotAtSafePoint(JSContext*, void*, bool) (MethodJIT.cpp:1131)
==44076==    by 0x53CFE4: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:1374)
==44076==    by 0x7AAD98: js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, JS::Value*, bool) (MethodJIT.cpp:1070)
==44076==    by 0x7AAF73: CheckStackAndEnterMethodJIT(JSContext*, js::StackFrame*, void*, bool) (MethodJIT.cpp:1101)
==44076==    by 0x7AB0C2: js::mjit::JaegerShot(JSContext*, bool) (MethodJIT.cpp:1119)
==44076==    by 0x539227: js::RunScript(JSContext*, JS::Handle<JSScript*>, js::StackFrame*) (jsinterp.cpp:323)
==44076==    by 0x53A212: js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::ExecuteType, js::StackFrame*, JS::Value*) (jsinterp.cpp:515)
==44076==    by 0x53A46C: js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) (jsinterp.cpp:553)
==44076==    by 0x453569: JS_ExecuteScript(JSContext*, JSObject*, JSScript*, JS::Value*) (jsapi.cpp:5540)
==44076==  Address 0x58 is not stack'd, malloc'd or (recently) free'd



Since this bug is with TI disabled, it could affect at least the ARMv6 devices where only JM is used. S-s because this is a heap crash.
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision fc1684f4d3a9).
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:bisectfix]
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   113132:dd68409d7810
user:        Phil Ringnalda
date:        Tue Nov 13 22:08:22 2012 -0800
summary:     Back out 3da143341145 (bug 784294) and 862f9cd7eb0b (bug 791850) for breaking Jetpack

This iteration took 100.782 seconds to run.
This is fixed by the backout in comment 3.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
Can this be put in testsuite?
Flags: in-testsuite?
Whiteboard: [jsbugmon:] → [jsbugmon:][adv-main19-]
Group: core-security
You need to log in before you can comment on or make changes to this bug.