1061534 - Assertion failure: obj->is<JSObject>() || obj->is<ArrayObject>(), at jsobj.cpp:2004

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c360f3d1c00d (run with --fuzzing-safe --no-threads --ion-eager):


test = (function () {
  function f() {};
  return "var obj = { x : 2 };" + f.toSource() + (4);
})();
evalWithCache(test, {});
function evalWithCache(code, ctx) {
  code = cacheEntry(code);
  var res1 = evaluate(code, Object.create(ctx, {saveBytecode: { value: true } }));
}
if (typeof assertThrowsInstanceOf === 'undefined') {
    var assertThrowsInstanceOf = function assertThrowsInstanceOf(f, ctor, msg) {};
}
evaluate('evaluate(\'assertThrowsInstanceOf(function () {}, ["jak", "ms"]);\', { noScriptRval : true, compileAndGo : true  })');

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

This doesn't crash but the code later on seems to assume that if the object is not an Array, it is a JSObject and treats it as such. Not sure what implications this has, so marking s-s for now.

Comment 3

[Andrew McCreight [:mccr8]]

It looks like maybe you are the last one to look at this function in bug 1057571, Brian, could you take a look?  Thanks.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

This looks like a bug in MCloneLiteral codegen.  The wrong register is used, which is pretty bad, but I don't know how and when we use the cloneSingletons option on compartments so it's hard to gauge how serious this is.

Comment 5

[Nicolas B. Pierron [:nbp]]

(In reply to Brian Hackett (:bhackett) from comment #4)
> This looks like a bug in MCloneLiteral codegen.  The wrong register is used,
> which is pretty bad, but I don't know how and when we use the
> cloneSingletons option on compartments so it's hard to gauge how serious
> this is.

We use cloneSingletons when we intend to save the code that we produced after having executed it.  It was added for the start-up cache projects which keep being postponed.  So I do not expect anybody to be using it yet, except our test suite. The |evalWithCache| function provided in the test suite is used to check that we do not lose any information by serializing and deserializing, such as type information.

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d680084327eb

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d680084327eb