Closed
Bug 1306913
Opened 8 years ago
Closed 8 years ago
MOZ_ASSERT crashes in ShellOpenAsmJSCacheEntryForWrite() while running jit-tests
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla52
Tracking | Status | |
---|---|---|
firefox52 | --- | fixed |
People
(Reporter: jbeich, Unassigned)
References
Details
(Keywords: regression)
Attachments
(2 files)
After bug 900669 comment 78 many tests started to fail but nowadays the list is short
js/src/jit-test/tests/asm.js/testCaching.js
--wasm-always-baseline js/src/jit-test/tests/asm.js/testCaching.js
js/src/jit-test/tests/asm.js/testCloning.js
--wasm-always-baseline js/src/jit-test/tests/asm.js/testCloning.js
js/src/jit-test/tests/asm.js/testBullet.js
--wasm-always-baseline js/src/jit-test/tests/asm.js/testBullet.js
js/src/jit-test/tests/asm.js/testHeapAccess.js
--wasm-always-baseline js/src/jit-test/tests/asm.js/testHeapAccess.js
js/src/jit-test/tests/asm.js/testSource.js
--wasm-always-baseline js/src/jit-test/tests/asm.js/testSource.js
js/src/jit-test/tests/asm.js/testStackWalking.js
--wasm-always-baseline js/src/jit-test/tests/asm.js/testStackWalking.js
js/src/jit-test/tests/latin1/asm.js
which points at
* thread #1: tid = 101293, 0x0000000000438c1f js`ShellOpenAsmJSCacheEntryForWrite(global=<unavailable>, installed=<unavailable>, begin=<unavailable>, end=<unavailable>, serializedSize=5216, memoryOut=0x00007fffffffbab0, handleOut=0x0000000802ba5c6a) + 255 at js.cpp:6850, stop reason = signal SIGSEGV: address access protected (fault address: 0x801d37000)
frame #0: 0x0000000000438c1f js`ShellOpenAsmJSCacheEntryForWrite(global=<unavailable>, installed=<unavailable>, begin=<unavailable>, end=<unavailable>, serializedSize=5216, memoryOut=0x00007fffffffbab0, handleOut=0x0000000802ba5c6a) + 255 at js.cpp:6850
6847
6848 // The embedding added the cookie so strip it off of the buffer returned to
6849 // the JS engine. The asmJSCacheCookie will be written on close, below.
-> 6850 MOZ_ASSERT(*(uint32_t*)memory == 0);
6851 *memoryOut = (uint8_t*)memory + sizeof(uint32_t);
6852 *handleOut = fd.forget();
6853 return JS::AsmJSCache_Success;
Comment hidden (mozreview-request) |
Summary: MOZ_ASSERT crashes in ShellOpenAsmJSCacheEntryForWrite() → MOZ_ASSERT crashes in ShellOpenAsmJSCacheEntryForWrite() while running jit-tests
Comment 2•8 years ago
|
||
mozreview-review |
Comment on attachment 8796886 [details]
Bug 1306913 - Allow MOZ_ASSERT to check contents before disabling PROT_READ.
https://reviewboard.mozilla.org/r/82592/#review81404
Oh wow, that's a pretty silly bug, thanks! I guess FreeBSD is the only OS to prevent reads when only PROT_WRITE?
Attachment #8796886 -
Flags: review?(luke) → review+
(In reply to Luke Wagner [:luke] from comment #2)
> FreeBSD is the only OS to prevent reads when only PROT_WRITE?
No, write() to stdout succeeds but dereferencing crashes. This also happens at least on DragonFly and OpenBSD. -fsanitize=address shows something but not enough without symbols.
Attachment #8797275 -
Attachment mime type: text/x-csrc → text/plain
Updated•8 years ago
|
Keywords: checkin-needed
Pushed by cbook@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/5a0c00314737
Allow MOZ_ASSERT to check contents before disabling PROT_READ. r=luke
Keywords: checkin-needed
Comment 5•8 years ago
|
||
bugherder |
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
You need to log in
before you can comment on or make changes to this bug.
Description
•