1263886 - Assertion failure: !unknownProperties(), at js/src/vm/TypeInference-inl.h:1043 with OOM

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 29d5a4175c8b (build with --enable-optimize --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug, run with --fuzzing-safe --ion-eager --ion-offthread-compile=off):

lfLogBuffer = `
o = { w: { x: { } } }
`.split('\n'), {
     value: {}
}
loadFile(lfLogBuffer.shift());
loadFile(lfLogBuffer.shift());
function loadFile(lfVarx) {
    oomTest(function() {
        eval(lfVarx)
    })
}



Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x000000000062a710 in js::ObjectGroup::maybeGetProperty (this=0x7ffff7e6cc70, id=...) at js/src/vm/TypeInference-inl.h:1043
#0  0x000000000062a710 in js::ObjectGroup::maybeGetProperty (this=0x7ffff7e6cc70, id=...) at js/src/vm/TypeInference-inl.h:1043
#1  0x0000000000bb2a88 in js::UnboxedLayout::makeConstructorCode (cx=cx@entry=0x7ffff6908800, group=..., group@entry=...) at js/src/vm/UnboxedObject.cpp:185
#2  0x0000000000bb471c in js::UnboxedPlainObject::createWithProperties (cx=cx@entry=0x7ffff6908800, group=..., group@entry=..., newKind=newKind@entry=js::TenuredObject, properties=properties@entry=0x7ffff6905580) at js/src/vm/UnboxedObject.cpp:704
#3  0x0000000000ab53e5 in js::ObjectGroup::newPlainObject (cx=cx@entry=0x7ffff6908800, properties=0x7ffff6905580, nproperties=1, newKind=newKind@entry=js::TenuredObject) at js/src/vm/ObjectGroup.cpp:1276
#4  0x0000000000c109c2 in js::frontend::ParseNode::getConstantValue (this=<optimized out>, cx=cx@entry=0x7ffff6908800, allowObjects=allowObjects@entry=js::frontend::ParseNode::AllowObjects, vp=..., vp@entry=..., compare=compare@entry=0x0, ncompare=ncompare@entry=0, newKind=newKind@entry=js::TenuredObject) at js/src/frontend/BytecodeEmitter.cpp:4923
#5  0x0000000000c1060e in js::frontend::ParseNode::getConstantValue (this=<optimized out>, cx=0x7ffff6908800, allowObjects=allowObjects@entry=js::frontend::ParseNode::AllowObjects, vp=vp@entry=..., compare=compare@entry=0x0, ncompare=ncompare@entry=0, newKind=newKind@entry=js::SingletonObject) at js/src/frontend/BytecodeEmitter.cpp:4898
#6  0x0000000000c114e2 in js::frontend::BytecodeEmitter::emitSingletonInitialiser (this=this@entry=0x7fffffffa8a0, pn=pn@entry=0x7ffff698b3a8) at js/src/frontend/BytecodeEmitter.cpp:4945
#7  0x0000000000c2133b in js::frontend::BytecodeEmitter::emitObject (this=this@entry=0x7fffffffa8a0, pn=pn@entry=0x7ffff698b3a8) at js/src/frontend/BytecodeEmitter.cpp:8072
#8  0x0000000000c12f99 in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffa8a0, pn=pn@entry=0x7ffff698b3a8, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:8937
#9  0x0000000000c1ccfe in js::frontend::BytecodeEmitter::emitAssignment (this=this@entry=0x7fffffffa8a0, lhs=0x7ffff698b338, op=JSOP_NOP, rhs=0x7ffff698b3a8) at js/src/frontend/BytecodeEmitter.cpp:4743
#10 0x0000000000c12f07 in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffa8a0, pn=pn@entry=0x7ffff698b530, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:8740
#11 0x0000000000c1f577 in js::frontend::BytecodeEmitter::emitStatement (this=this@entry=0x7fffffffa8a0, pn=pn@entry=0x7ffff698b568) at js/src/frontend/BytecodeEmitter.cpp:7142
#12 0x0000000000c130b1 in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffa8a0, pn=pn@entry=0x7ffff698b568, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:8713
#13 0x0000000000c1f44e in js::frontend::BytecodeEmitter::emitStatementList (this=this@entry=0x7fffffffa8a0, pn=pn@entry=0x7ffff698b300) at js/src/frontend/BytecodeEmitter.cpp:7086
#14 0x0000000000c12fd1 in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffa8a0, pn=pn@entry=0x7ffff698b300, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:8708
#15 0x0000000000c18c1d in js::frontend::BytecodeEmitter::emitLexicalScope (this=this@entry=0x7fffffffa8a0, pn=pn@entry=0x7ffff698b2c8) at js/src/frontend/BytecodeEmitter.cpp:5451
#16 0x0000000000c1346b in js::frontend::BytecodeEmitter::emitTree (this=this@entry=0x7fffffffa8a0, pn=0x7ffff698b2c8, emitLineNote=emitLineNote@entry=js::frontend::BytecodeEmitter::EMIT_LINENOTE) at js/src/frontend/BytecodeEmitter.cpp:8863
#17 0x0000000000c1373b in BytecodeCompiler::prepareAndEmitTree (this=this@entry=0x7fffffff9c00, ppn=ppn@entry=0x7fffffff97f0) at js/src/frontend/BytecodeCompiler.cpp:356
#18 0x0000000000c13df9 in BytecodeCompiler::compileScript (this=this@entry=0x7fffffff9c00, scopeChain=..., scopeChain@entry=..., evalCaller=evalCaller@entry=...) at js/src/frontend/BytecodeCompiler.cpp:539
#19 0x0000000000c14133 in js::frontend::CompileScript (cx=cx@entry=0x7ffff6908800, alloc=<optimized out>, scopeChain=scopeChain@entry=..., enclosingStaticScope=..., enclosingStaticScope@entry=..., evalCaller=evalCaller@entry=..., options=..., srcBuf=..., source_=0x7ffff7e8b040, extraSct=extraSct@entry=0x0, sourceObjectOut=sourceObjectOut@entry=0x0) at js/src/frontend/BytecodeCompiler.cpp:742
#20 0x00000000008468bc in EvalKernel (cx=cx@entry=0x7ffff6908800, args=..., evalType=evalType@entry=DIRECT_EVAL, caller=..., scopeobj=scopeobj@entry=..., pc=<optimized out>) at js/src/builtin/Eval.cpp:319
#21 0x0000000000846d83 in js::DirectEval (cx=cx@entry=0x7ffff6908800, args=...) at js/src/builtin/Eval.cpp:439
#22 0x0000000000617535 in js::jit::DoCallFallback (cx=0x7ffff6908800, frame=0x7fffffffb848, stub_=<optimized out>, argc=<optimized out>, vp=0x7fffffffb7f8, res=...) at js/src/jit/BaselineIC.cpp:6100
#23 0x00007ffff7ff1a1f in ?? ()
[...]
rax	0x0	0
rbx	0x7ffff7e6cc70	140737352486000
rcx	0x7ffff6ca588d	140737333844109
rdx	0x0	0
rsi	0x7ffff6f7a9d0	140737336814032
rdi	0x7ffff6f791c0	140737336807872
rbp	0x7fffffff7eb0	140737488322224
rsp	0x7fffffff7e80	140737488322176
r8	0x7ffff7fdf7c0	140737354004416
r9	0x6372732f736a2f6c	7165916604736876396
r10	0x7fffffff7c40	140737488321600
r11	0x7ffff6c27ee0	140737333329632
r12	0x7ffff7e00b68	140737352043368
r13	0x27ff0000	671023104
r14	0x7ffff69055a0	140737330042272
r15	0x7fffffff8180	140737488322944
rip	0x62a710 <js::ObjectGroup::maybeGetProperty(jsid)+880>
=> 0x62a710 <js::ObjectGroup::maybeGetProperty(jsid)+880>:	movl   $0x413,0x0
   0x62a71b <js::ObjectGroup::maybeGetProperty(jsid)+891>:	callq  0x4ab6f0 <abort()>


Assert is similar to bug 1254172, but the stack differs.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Brian, are groups with unknown properties (due to OOM I think) expected here?

Comment 2

[Brian Hackett [Laid off!]]

Comment on attachment 8740393 [details] [diff] [review]
Patch

Review of attachment 8740393 [details] [diff] [review]:
-----------------------------------------------------------------

Groups with unknown properties are allowed here.  We don't make assumptions about the relationship between an object's type information and any unboxed representation it has.

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bd7b47bc9327

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/bd7b47bc9327