1023145 - Assertion failure: args[0].isObject(), at vm/SelfHosting.cpp:522 or Crash [@ js::intrinsic_UnsafeGetReservedSlot] with SIMD

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 9dc0ffca10f4 (run with --fuzzing-safe):


delete Object.prototype.__proto__;
var int32x4 = SIMD.int32x4;
var Array = int32x4.array(1);
var array = new Array([int32x4(1, 2, 3, 4)]);

Comment 1

[Christian Holler (:decoder)]

The crash seems like a null-deref, needinfo on Niko because it's SIMD-related.

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140607030736" and the hash "f56234ba7ec7".
The "bad" changeset has the timestamp "20140607033236" and the hash "731411eebd0a".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=f56234ba7ec7&tochange=731411eebd0a

Comment 4

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 5

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 6

[Jason Orendorff [:jorendorff]]

bbouvier, can you take this? It's happening because builtin/TypedObject.js contains this:

    function TypedObjectTypeDescr(typedObj) {
      return TYPROTO_DESCR(typedObj.__proto__);
    }

but user scripts can delete Object.prototype.__proto__. The fix is to declare

    var std_Object_getPrototypeOf = Object.getPrototypeOf;

in Utilities.js, and use that. Kind of surprising we don't have it already.

Comment 7

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Patch + test

Thanks jorendorff for the needinfo! The fix you've suggested works perfectly.

Comment 8

[Till Schneidereit [:till]]

Comment on attachment 8452972 [details] [diff] [review]
Patch + test

Review of attachment 8452972 [details] [diff] [review]:
-----------------------------------------------------------------

Surprising we didn't have that indeed!

Comment 9

[Benjamin Bouvier [:bbouvier] (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b69f005c1781

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b69f005c1781