853576 - Assertion failure: idx < arrobj->getDenseInitializedLength(), at vm/SelfHosting.cpp:373 or Crash [@ js::intrinsic_UnsafeSetElement] with ParallelArray

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 1d6fe70c79c5 (no options required):


var len = 2;
function add1(x) { return x+1; }
var p = new ParallelArray(len, add1);
var idx = [0,0].concat(build(len-4, add1)).concat([len-3,len-3]);
var revidx = idx.reverse();
var r = p.scatter(revidx, 0, function (x,y) { return x+y; }, len-2, {});

Comment 1

[Christian Holler (:decoder)]

Crash trace:

==13859== Invalid read of size 8
==13859==    at 0x5EA9A8: js::intrinsic_UnsafeSetElement(JSContext*, unsigned int, JS::Value*) (jsobjinlines.h:449)
==13859==    by 0x4B8260: js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) (jscntxtinlines.h:338)
==13859==    by 0x4AC763: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2396)
==13859==    by 0x4B80FA: js::RunScript(JSContext*, js::StackFrame*) (jsinterp.cpp:341)
==13859==    by 0x4B84AC: js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) (jsinterp.cpp:398)
==13859==    by 0x4AC763: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2396)
==13859==    by 0x4B80FA: js::RunScript(JSContext*, js::StackFrame*) (jsinterp.cpp:341)
==13859==    by 0x4B84AC: js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) (jsinterp.cpp:398)
==13859==    by 0x4AC763: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2396)
==13859==    by 0x4B80FA: js::RunScript(JSContext*, js::StackFrame*) (jsinterp.cpp:341)
==13859==    by 0x4BDE52: js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) (jsinterp.cpp:531)
==13859==    by 0x424700: JS_ExecuteScript(JSContext*, JSObject*, JSScript*, JS::Value*) (jsapi.cpp:5525)
==13859==  Address 0x80704e068 is not stack'd, malloc'd or (recently) free'd


S-s due to invalid read on bad address.

Comment 2

[Niko Matsakis [:nmatsakis]]

Attachment: Remember that indices can be *negative*

Comment 3

[Niko Matsakis [:nmatsakis]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bab9914e9a31

Comment 4

[Niko Matsakis [:nmatsakis]]

(No branches are affected)

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Backed out for SM rootanalysis orange.
https://hg.mozilla.org/integration/mozilla-inbound/rev/bc6dfc2e65f0

https://tbpl.mozilla.org/php/getParsedLog.php?id=21184667&tree=Mozilla-Inbound

FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js | --no-jm: /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js:6:0 Error: index in scatter vector out of bounds
FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js | --ion-eager: /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js:6:0 Error: index in scatter vector out of bounds
FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js | --no-ion --no-jm --no-ti: /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js:6:0 Error: index in scatter vector out of bounds
FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js | --no-ion --no-ti: /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js:6:0 Error: index in scatter vector out of bounds
FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js | --no-ion --no-ti --always-mjit --debugjit: /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js:6:0 Error: index in scatter vector out of bounds
FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js | --no-ion --no-jm: /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js:6:0 Error: index in scatter vector out of bounds
FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js | --no-ion: /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js:6:0 Error: index in scatter vector out of bounds
FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js | --no-ion --always-mjit: /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js:6:0 Error: index in scatter vector out of bounds
TEST-PASS | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853573.js | --no-ion --no-jm
FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js | --no-ion --always-mjit --debugjit: /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js:6:0 Error: index in scatter vector out of bounds
FAIL - /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js
TEST-UNEXPECTED-FAIL | /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js | --no-ion --debugjit: /builds/slave/m-in_l64-d_sm-rootanalysis-000/src/js/src/jit-test/tests/parallelarray/bug853576.js:6:0 Error: index in scatter vector out of bounds

Comment 6

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, failed due to error (try manually).

Comment 7

[Niko Matsakis [:nmatsakis]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8f1f83f4f183

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/8f1f83f4f183

Comment 9

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.