851107 - Rooting Analysis: Crash on Heap near [@ execute] with RegExp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central built with --enable-root-analysis, revision 8e68f4d73ec4 (run with ):


gczeal(6);
var re = /./;
re.lastIndex = {};
re.exec((/[]\u0032/m ));

Comment 1

[Christian Holler (:decoder)]

Crash trace:

Program received signal SIGSEGV, Segmentation fault.
0xf7fc702e in ?? ()
(gdb) bt
#0  0xf7fc702e in ?? ()
#1  0x0841adc5 in execute (output=<optimized out>, length=<optimized out>, start=<optimized out>, input=0xda430028, this=0x89a9dec) at ../yarr/YarrJIT.h:134
#2  js::RegExpShared::execute (this=0x89a9de0, cx=0x8948a78, chars=0xda430028, length=<optimized out>, lastIndex=0xffffc06c, matches=...) at js/src/vm/RegExpObject.cpp:555
#3  0x084232d2 in ExecuteRegExpImpl (cx=0x8948a78, res=0x8970240, re=..., input="/[]\\u0032/m", chars=0xda430028, length=11, lastIndex=0xffffc06c, matches=...)
    at js/src/builtin/RegExp.cpp:133
#4  0x08425b67 in js::ExecuteRegExp (cx=0x8948a78, regexp=(JSObject * const) 0xf742f150 [object RegExp], string="/[]\\u0032/m", matches=...) at js/src/builtin/RegExp.cpp:598
#5  0x08425fc0 in regexp_exec_impl (cx=0x8948a78, args=...) at js/src/builtin/RegExp.cpp:646
#6  0x08426156 in CallNonGenericMethod (args=..., Impl=0x8425e30 <regexp_exec_impl(JSContext*, JS::CallArgs)>, Test=0x841f5a0 <IsRegExp(JS::Value const&)>, cx=0x8948a78) at ../jsapi.h:884
#7  js::regexp_exec (cx=0x8948a78, argc=1, vp=0xf7693060) at js/src/builtin/RegExp.cpp:663
#8  0x081a9f4f in CallJSNative (args=..., native=<optimized out>, cx=0x8948a78) at ../jscntxtinlines.h:327
#9  js::InvokeKernel (cx=0x8948a78, args=..., construct=js::NO_CONSTRUCT) at js/src/jsinterp.cpp:383
#10 0x08198120 in js::Interpret (cx=0x8948a78, entryFrame=0xf7693028, interpMode=js::JSINTERP_NORMAL) at js/src/jsinterp.cpp:2361
#11 0x081a9bac in js::RunScript (cx=0x8948a78, fp=0xf7693028) at js/src/jsinterp.cpp:340
#12 0x081ac560 in ExecuteKernel (result=0x0, evalInFrame=..., thisv=..., scopeChainArg=..., script=0xf7425100, cx=<optimized out>, type=<optimized out>) at js/src/jsinterp.cpp:530
#13 js::Execute (cx=0x8948a78, script=0xf7425100, scopeChainArg=(JSObject &) @0xf7421040 [object global] delegate, rval=0x0) at js/src/jsinterp.cpp:570
#14 0x0807f89b in JS_ExecuteScript (cx=0x8948a78, objArg=(JSObject *) 0xf7421040 [object global] delegate, scriptArg=0xf7425100, rval=0x0) at js/src/jsapi.cpp:5487
#15 0x08059b22 in Process (cx=0x8948a78, obj_=<optimized out>, filename=0xffffd177 "min.js", forceTTY=false) at js/src/shell/js.cpp:467
#16 0x0806150f in ProcessArgs (op=0xffffceb0, obj_=<optimized out>, cx=0x8948a78) at js/src/shell/js.cpp:5023
#17 Shell (cx=0x8948a78, op=0xffffceb0, envp=0xffffcfe0) at js/src/shell/js.cpp:5060
#18 0x0804b805 in main (argc=2, argv=0xffffcfd4, envp=0xffffcfe0) at js/src/shell/js.cpp:5283

Comment 2

[Terrence Cole [:terrence]]

I was not able to reproduce this with my existing build. What configure line, arch, and compiler is is this with?

Comment 3

[Christian Holler (:decoder)]

This is 32 bit Linux (Ubuntu 12.04 LTS), the configure line is

--enable-debug --enable-optimize --enable-valgrind --target=i686-pc-linux-gnu --enable-root-analysis

and the compiler is GCC 4.6.3.

Comment 4

[Terrence Cole [:terrence]]

Attachment: v0

This is another two instances of inline chars getting poisoned. We're going to need to fix this general class of problems before we can GGC strings. Until then, I think it's fine to just SkipRoot the one and move the other below the GC.

Comment 5

[Steve Fink [:sfink] [:s:]]

Comment on attachment 725157 [details] [diff] [review]
v0

Review of attachment 725157 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/RegExpObject.cpp
@@ +569,5 @@
>  RegExpRunStatus
>  RegExpShared::executeMatchOnly(JSContext *cx, const jschar *chars, size_t length,
>                                 size_t *lastIndex, MatchPair &match)
>  {
> +    /* These chars maybe inline in a string. */

s/maybe/may be/

Comment 6

[Steve Fink [:sfink] [:s:]]

Oh, and maybe mention bug 846011. Unless you think we'll end up with too much clutter from that.

Comment 7

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ea6b05238e68

Comment 8

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/ea6b05238e68