Segmentation fault in build_backtrace

[nE0sIghT]

Hello!

We are using the quickjs-ng 0.10.1 tag within a fork of the test-nn-server project, and we are encountering an intermittent segmentation fault in the build_backtrace method.

Here is the backtrace:

test-nn-server is a TCP server that instantiates a JSRuntime statically and a JSContext per connection. We call JS_UpdateStackTop for each connection.

Any suggestions?

[saghul]

Do you have a way to reproduce it?

[nE0sIghT]

Do you have a way to reproduce it?

No, sadly.

Moreover, to reproduce this issue, we run a kind of "stress test" with 10+ clients. It segfaults after 3–4 hours.

We are now trying with a max stack size of 0; however, our previous tests with this setting led to the very same segfault.

[past-due]

Moreover, to reproduce this issue, we run a kind of "stress test" with 10+ clients. It segfaults after 3–4 hours.

We are now trying with a max stack size of 0; however, our previous tests with this setting led to the very same segfault.

Is there any change if you update to commit 3c78c95 (which includes various OOM and memory leak fixes)?

[nE0sIghT]

Sure, thanks! I will return with results in a day or two

[nE0sIghT]

We hit a segfault at the same location with commit 3c78c95

For now we will try to recreate JSRuntime after some requests

[bnoordhuis]

Can you show the disassembly around the crash site and the contents of registers? Maybe that provides a clue.

[nE0sIghT]

I will try to create reproducible case and return to you with results in several days

[past-due]

One quick note:

cur_func is documented as possibly being an undefined value:
https://github.com/quickjs-ng/quickjs/blob/3d3b58d8815f0eef8122fad142a65f3bd21d273b/quickjs.c#L337

JSValue cur_func; /* current function, JS_UNDEFINED if the frame is detached */

But build_backtrace seems to be missing validity checks on sf->cur_func before using JS_VALUE_GET_OBJ and accessing p->class_id.

For example, look at JS_GetClassID:
https://github.com/quickjs-ng/quickjs/blob/3d3b58d8815f0eef8122fad142a65f3bd21d273b/quickjs.c#L3542-L3549

[bnoordhuis]

In build_backtrace, sf iterates over the rt->current_stack_frame linked list. Barring bugs sf->cur_func should always point to a valid JS function. Easy enough to check though:

diff --git a/quickjs.c b/quickjs.c
index 01eb101..abbfedb 100644
--- a/quickjs.c
+++ b/quickjs.c
@@ -6833,6 +6833,7 @@ static void build_backtrace(JSContext *ctx, JSValueConst error_val,
             continue;
         }
 
+        assert(JS_GetFunctionBytecode(sf->cur_func));
         p = JS_VALUE_GET_OBJ(sf->cur_func);
         b = NULL;
         backtrace_barrier = false;

[bnoordhuis]

I forgot about native functions. Try this patch instead:

diff --git a/quickjs.c b/quickjs.c
index 01eb101..95aa90e 100644
--- a/quickjs.c
+++ b/quickjs.c
@@ -6833,7 +6833,9 @@ static void build_backtrace(JSContext *ctx, JSValueConst error_val,
             continue;
         }
 
+        assert(JS_VALUE_GET_TAG(sf->cur_func) == JS_TAG_OBJECT);
         p = JS_VALUE_GET_OBJ(sf->cur_func);
+        assert(JS_GetFunctionBytecode(sf->cur_func) || p->class_id == JS_CLASS_C_FUNCTION);
         b = NULL;
         backtrace_barrier = false;