Assertion failure: global->as<GlobalObject>().getPrototype(Class::KEY).isUndefined(), at js/src/asmjs/WasmJS.cpp:786

RESOLVED FIXED in Firefox 50

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: gkw, Assigned: luke)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla50
x86_64
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox50 fixed)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(3 attachments)

(Reporter)

Description

2 years ago
The following testcase crashes on mozilla-central revision 2f9e69c982f1 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager --no-baseline):

Object.getOwnPropertyNames(this);
s = newGlobal();
evalcx("\
    /x/;\
    oomTest(function() {\
        this[\"\"];\
        void 0;\
        Object.freeze(this);\
        l(undefined)();\
        O;\
        t;\
        0;\
        ({e});\
        i;\
        0;\
        ({ z: p ? 0 : 0});\
        s;\
    });\
", s);


Backtrace:

0   js-dbg-64-dm-clang-darwin-2f9e69c982f1	0x000000010d17b6bc js::InitWebAssemblyClass(JSContext*, JS::Handle<JSObject*>) + 4652 (WasmJS.cpp:786)
1   js-dbg-64-dm-clang-darwin-2f9e69c982f1	0x000000010d4e789e js::GlobalObject::resolveConstructor(JSContext*, JS::Handle<js::GlobalObject*>, JSProtoKey) + 414 (GlobalObject.cpp:172)
2   js-dbg-64-dm-clang-darwin-2f9e69c982f1	0x000000010d4e941b js::GlobalObject::initStandardClasses(JSContext*, JS::Handle<js::GlobalObject*>) + 107 (GlobalObject.cpp:425)
3   js-dbg-64-dm-clang-darwin-2f9e69c982f1	0x000000010d2bcb89 JS_EnumerateStandardClasses(JSContext*, JS::Handle<JSObject*>) + 265 (RootingAPI.h:704)
4   js-dbg-64-dm-clang-darwin-2f9e69c982f1	0x000000010d338894 Snapshot(JSContext*, JS::Handle<JSObject*>, unsigned int, JS::AutoVectorRooter<jsid>*) + 452 (jsiter.cpp:387)
5   js-dbg-64-dm-clang-darwin-2f9e69c982f1	0x000000010d37a70f js::PreventExtensions(JSContext*, JS::Handle<JSObject*>, JS::ObjectOpResult&) + 351 (jsobj.cpp:2635)
6   js-dbg-64-dm-clang-darwin-2f9e69c982f1	0x000000010d370398 js::SetIntegrityLevel(JSContext*, JS::Handle<JSObject*>, js::IntegrityLevel) + 184 (jsobj.cpp:2656)
7   js-dbg-64-dm-clang-darwin-2f9e69c982f1	0x000000010d6e2e32 obj_freeze(JSContext*, unsigned int, JS::Value*) + 210 (RootingAPI.h:704)
/snip

For detailed crash information, see attachment.
(Reporter)

Comment 1

2 years ago
Created attachment 8771605 [details]
Detailed Crash Information
(Reporter)

Comment 2

2 years ago
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/7f9ce3eb7b9b
user:        Luke Wagner
date:        Wed Jul 13 12:34:44 2016 -0500
summary:     Bug 1284155 - Baldr: add Table.prototype.length getter (r=bbouvier)

Luke, is bug 1284155 a likely regressor?
Blocks: 1284155
Flags: needinfo?(luke)
(Reporter)

Comment 3

2 years ago
Created attachment 8771606 [details]
OOM_VERBOSE=1 stack from m-c rev 2f9e69c982f1
Created attachment 8771684 [details] [diff] [review]
fix-oom-init-bug

D'oh: if global initialization fails after we've initialized one of the JSProto_Wasm* but before the final JSProto_WebAssembly constructor has been written to the GlobalObject, then we can later restart initialization and then attempt to re-initialize the JSProto_Wasm*.  Simple fix with that understanding.
Assignee: nobody → luke
Status: NEW → ASSIGNED
Flags: needinfo?(luke)
Attachment #8771684 - Flags: review?(bbouvier)
Comment on attachment 8771684 [details] [diff] [review]
fix-oom-init-bug

Review of attachment 8771684 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good, thanks.
Attachment #8771684 - Flags: review?(bbouvier) → review+

Comment 6

2 years ago
Pushed by lwagner@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/669fdfdba6eb
Baldr: only do global initialization after everything else has succeeded (r=bbouvier)
(Reporter)

Updated

2 years ago
Duplicate of this bug: 1287688

Comment 8

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/669fdfdba6eb
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
status-firefox50: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla50
You need to log in before you can comment on or make changes to this bug.