1006065 - Assertion failure: obj->is<ArrayObject>() loading a washingtonpost.com blog

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: gdb output with stacks and object dump

I just crashed while loading
http://www.washingtonpost.com/blogs/the-fix/wp/2014/05/05/martin-omalley-did-a-reddit-ama-it-didnt-go-very-well/
in a debug build on 64-bit Linux.

Running a build with SourceStamp=d9e2937142c7, which actually means I was
running mozilla-central revision cfde3603b020 plus my patch queue as of
its revision 0ede7103166b pushed up to the patch named ae2b85aaa9f3.

It crashed with the following assertion failure:
Assertion failure: obj->is<ArrayObject>(), at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jit/VMFunctions.cpp:368

Comment 1

[Jan de Mooij [:jandem]]

Yeah, this assert is bogus. When Ion optimizes splice calls, it doesn't check that the object is an array at compile time (and it doesn't have to), so at runtime we can get non-array objects.

A bit surprising the fuzzers didn't find this too, here's a simple shell testcase:

function f() {
    var o = {splice: [].splice};
    for (var i=0; i<2000; i++) {
	o.splice(0, 1);
    }
}
f();

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

Removes the assert and adds a testcase, since apparently our tests don't cover this.

Comment 3

[Hannes Verschore [:h4writer]]

Comment on attachment 8417984 [details] [diff] [review]
Patch

Review of attachment 8417984 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah indeed a bogus assert.

Comment 4

[Carsten Book [:Tomcat]]

also different site is also http://docs.openstack.org/havana/install-guide/install/apt-debian/content/ - run with bughunter into it

Comment 5

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/83d8155eba84

Comment 6

[Jan de Mooij [:jandem]]

Comment on attachment 8417984 [details] [diff] [review]
Patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 939115.
User impact if declined: Bogus assert in debug builds.
Testing completed (on m-c, etc.): On m-i.
Risk to taking this patch (and alternatives if risky): None; just removes a (debug-only) assert so makes no difference for release builds.
String or IDL/UUID changes made by this patch: None.

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/83d8155eba84

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/24b3df4c5810