1096016 - Crash [@ compartment] or Crash [@ ObjectType] with poisoned crash pattern and TypedObject

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision d380166816dd (run with --no-threads --fuzzing-safe --ion-eager):


var T = TypedObject;
var ObjectStruct = new T.StructType({f: T.Object});
var o = new ObjectStruct();
function testGC(o, p) {
    for (var i = 0; i < 5; i++) {
        minorgc();
        o.f >>=  p;
    }
}
testGC(o, {});

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Crash trace for the optimized build:


Program received signal SIGSEGV, Segmentation fault.
0x00000000007acb42 in ObjectType (obj=<optimized out>) at js/src/jsinferinlines.h:129
129             return Type(uintptr_t(obj) | 1);
#0  0x00000000007acb42 in ObjectType (obj=<optimized out>) at js/src/jsinferinlines.h:129
#1  GetValueType (val=...) at js/src/jsinferinlines.h:153
#2  GetValueType (val=...) at js/src/jsinfer.cpp:3608
#3  js::types::TypeMonitorResult (cx=0x16bf6d0, script=0x7ffff7e604a0, pc=0x1781ff5 ":", rval=...) at js/src/jsinfer.cpp:3619
#4  0x00000000005c8c93 in Monitor (rval=..., pc=<optimized out>, script=0x7ffff7e604a0, cx=0x16bf6d0) at js/src/jsinferinlines.h:753
#5  js::jit::DoTypeMonitorFallback (cx=0x16bf6d0, frame=<optimized out>, stub=0x16eff68, value=..., res=...) at js/src/jit/BaselineIC.cpp:1311
#6  0x00007ffff7ff250e in ?? ()
rcx     0x2b2b2b2b      3110627432037296939
=> 0x7acb42 <js::types::TypeMonitorResult(JSContext*, JSScript*, unsigned char*, JS::Value const&)+242>:        cmpq   $0x0,0x10(%rcx)


Marked s-s based on crash pattern. Needinfo from :nmatsakis as this seems to be a problem with TypedObject.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/4bdc3391644e
user:        Brian Hackett
date:        Tue Nov 04 18:21:47 2014 -0700
summary:     Bug 1091329 - Optimize writes to reference members of TypedObjects, r=nmatsakis,jandem.

This iteration took 356.618 seconds to run.

Comment 4

[Hannes Verschore [:h4writer]]

(In reply to Christian Holler (:decoder) from comment #3)
> JSBugMon: Bisection requested, result:
> autoBisect shows this is probably related to the following changeset:
> 
> The first bad revision is:
> changeset:   https://hg.mozilla.org/mozilla-central/rev/4bdc3391644e
> user:        Brian Hackett
> date:        Tue Nov 04 18:21:47 2014 -0700
> summary:     Bug 1091329 - Optimize writes to reference members of
> TypedObjects, r=nmatsakis,jandem.
> 
> This iteration took 356.618 seconds to run.

Could the above changeset have caused this?

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

The code adding post barriers for writes to typed objects is wrong, as the logic looks at the input value before any ToObjectOrNull instruction is inserted, and if the ToObjectOrNull produces a nursery object we don't end up with a post barrier.

Comment 6

[Niko Matsakis [:nmatsakis]]

Comment on attachment 8520213 [details] [diff] [review]
patch

Review of attachment 8520213 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/IonBuilder.cpp
@@ +11332,5 @@
>          break;
>        case ReferenceTypeDescr::TYPE_OBJECT:
> +        // Note: post barriers for object writes are added by the instruction's
> +        // type policy, which may insert ToObjectOrNull instructions that
> +        // affect whether a post barrier is needed.

I think this comment could be clarified. Something like:

// Note: We cannot necessarily tell at this point whether a post barrier is needed, because the type policy may insert ToObjectOrNull instructions later, and those may require a post barrier. Therefore, defer the insertion of post barriers to the type policy.

Comment 7

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/746283622967

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/746283622967

Comment 9

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.