995657 - Crash [@ JSRuntime::~JSRuntime] or Assertion failure: nextTos <= end_, at jsgc.h

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

gcparam('markStackLimit', 13);
gcparam('markStackLimit', 27);

asserts js debug shell on m-c changeset ebdf2740dc3e with --no-asmjs --no-baseline --no-ion at Assertion failure: nextTos <= end_, at jsgc.h

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

s-s just in case, since this involves gc. I'm not sure if this is bad at all, having no idea about gcparam or markStackLimit.

Setting needinfo? from Terrence as a start.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: regression window

Comment 2

[Terrence Cole [:terrence]]

Whoops, didn't mean to cancel needinfo here.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Jon Coppeard (:jonco)]

I don't think this is a security issue as gcparam() is only available in the shell.

The problem is that when we grow the mark stack, we clamp its size to the maximum set.  However, this may not allow enough space for the caller to push multiple values, and we hit an assert.  The fix is to check when we grow the stack and fail if the clamped size would not be large enough.

Comment 5

[Jon Coppeard (:jonco)]

Attachment: bug995657-markStackLimit

Comment 6

[Terrence Cole [:terrence]]

Comment on attachment 8406852 [details] [diff] [review]
bug995657-markStackLimit

Review of attachment 8406852 [details] [diff] [review]:
-----------------------------------------------------------------

r=me

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Jon Coppeard (:jonco) from comment #4)
> I don't think this is a security issue as gcparam() is only available in the
> shell.

Thanks! Opening up...

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Variants crash opt shell at JSRuntime::~JSRuntime.

Comment 9

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a668d68c3592

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/a668d68c3592