1331622 - js shell crashes on inferflags=results

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Sander Mathijs van Veen]

Attachment: print-infer-types-before-destroying-compartments.patch

Crash backtrace:

#0  0x0000000000b13d8c in js::DtoaCache::lookup (this=0x490, base=10, d=0.10000000000000001) at /home/smvv/work/mozilla-central/js/src/jscompartment.h:58
#1  0x0000000000b07a5f in NumberToStringWithBase<(js::AllowGC)1> (cx=0x7f161c638000, d=0.10000000000000001, base=10) at /home/smvv/work/mozilla-central/js/src/jsnum.cpp:1373
#2  0x0000000000b1a6b7 in js::NumberToString<(js::AllowGC)1> (cx=0x7f161c638000, d=0.10000000000000001) at /home/smvv/work/mozilla-central/js/src/jsnum.cpp:1397
#3  0x0000000000b970aa in js::ToStringSlow<(js::AllowGC)1> (cx=0x7f161c638000, arg=...) at /home/smvv/work/mozilla-central/js/src/jsstr.cpp:3086
#4  0x0000000000b81e98 in js::ToString<(js::AllowGC)1> (cx=0x7f161c638000, v=...) at /home/smvv/work/mozilla-central/js/src/jsstr.h:172
#5  0x0000000000b7d4c1 in js::ValueToSource (cx=0x7f161c638000, v=...) at /home/smvv/work/mozilla-central/js/src/jsstr.cpp:3160
#6  0x0000000000b7cfae in js::ValueToPrintable (cx=0x7f161c638000, vArg=..., bytes=0x7fffbeb85560, asSource=true) at /home/smvv/work/mozilla-central/js/src/jsstr.cpp:3052
#7  0x0000000000b5b963 in ToDisassemblySource (cx=0x7f161c638000, v=..., bytes=0x7fffbeb85560) at /home/smvv/work/mozilla-central/js/src/jsopcode.cpp:880
#8  0x0000000000b5c66a in js::Disassemble1 (cx=0x7f161c638000, script=..., pc=0x7f161b8e7e31 "<", loc=105, lines=true, sp=0x7fffbeb85630) at /home/smvv/work/mozilla-central/js/src/jsopcode.cpp:1045
#9  0x0000000000e436e7 in js::TypeScript::printTypes (this=0x7f161b8bf230, cx=0x7f161c638000, script=...) at /home/smvv/work/mozilla-central/js/src/vm/TypeInference.cpp:4582
#10 0x0000000000e3c5e0 in js::PrintTypes (cx=0x7f161c638000, comp=0x7f161c65f000, force=false) at /home/smvv/work/mozilla-central/js/src/vm/TypeInference.cpp:2620
#11 0x0000000000a7fd42 in js::DestroyContext (cx=0x7f161c638000) at /home/smvv/work/mozilla-central/js/src/jscntxt.cpp:135
#12 0x0000000000a1141a in JS_DestroyContext (cx=0x7f161c638000) at /home/smvv/work/mozilla-central/js/src/jsapi.cpp:486
#13 0x0000000000455eb1 in main (argc=3, argv=0x7fffbeb85bb8, envp=0x7fffbeb85bd8) at /home/smvv/work/mozilla-central/js/src/shell/js.cpp:7982

Notice that this=0x490 (bogus). This is the JSCompartment pointer of the exclusive context. See below:

 >>> up
#1  0x0000000000b07a5f in NumberToStringWithBase<(js::AllowGC)1> (cx=0x7f161c638000, d=0.10000000000000001, base=10) at /home/smvv/work/mozilla-central/js/src/jsnum.cpp:1373
1373            if (JSFlatString* str = comp->dtoaCache.lookup(base, d))
>>> p comp
$7 = (JSCompartment *) 0x0

Setting a breakpoint on the compartment, shows that the compartment is destroyed before the types are printed:

>>> p &cx->compartment_
$8 = (JSCompartment **) 0x7f161c6381b0
>>> watch *0x7f161c6381b0
>>> reverse-cont
Hardware watchpoint 1: *0x7f161c6381b0

Old value = 0
New value = 476442624
0x0000000000463977 in js::ExclusiveContext::setCompartment (this=0x7f161c638000, comp=0x0, maybeLock=0x0) at /home/smvv/work/mozilla-central/js/src/jscntxtinlines.h:446
446         compartment_ = comp;
>>> bt
#0  0x0000000000463977 in js::ExclusiveContext::setCompartment (this=0x7f161c638000, comp=0x0, maybeLock=0x0) at /home/smvv/work/mozilla-central/js/src/jscntxtinlines.h:446
#1  0x0000000000463673 in js::ExclusiveContext::leaveCompartment (this=0x7f161c638000, oldCompartment=0x0, maybeLock=0x0) at /home/smvv/work/mozilla-central/js/src/jscntxtinlines.h:417
#2  0x0000000000a11eee in JSAutoCompartment::~JSAutoCompartment (this=0x7fffbeb85870, __in_chrg=<optimized out>) at /home/smvv/work/mozilla-central/js/src/jsapi.cpp:750
#3  0x0000000000454884 in Shell (cx=0x7f161c638000, op=0x7fffbeb859c0, envp=0x7fffbeb85bd8) at /home/smvv/work/mozilla-central/js/src/shell/js.cpp:7579
#4  0x0000000000455df7 in main (argc=3, argv=0x7fffbeb85bb8, envp=0x7fffbeb85bd8) at /home/smvv/work/mozilla-central/js/src/shell/js.cpp:7963

Comment 1

[Sander Mathijs van Veen]

The patched attached to the bug moves the PrintTypes calls from DestroyContext() to the end of Shell(). In Shell(), the compartments are still live. When Shell() returns, the compartments are destroyed by the destructor of JSAutoCompartment (https://dxr.mozilla.org/mozilla-central/rev/88030580b14bb253a55bc174c987a9fa43c3fb55/js/src/shell/js.cpp#7579). Therefore, printing the types should happen before the end of Shell().

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 8827436 [details] [diff] [review]
print-infer-types-before-destroying-compartments.patch

Review of attachment 8827436 [details] [diff] [review]:
-----------------------------------------------------------------

This breaks INFERFLAGS=results in the browser, but I don't think anyone is using that and we can fix if needed. We already dump other things in Shell so adding PrintTypes there makes sense.

Comment 3

[Sander Mathijs van Veen]

Attachment: print-infer-types-before-destroying-compartments.patch

Rebased on top of mozilla-central.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8f45877833df
Print inference types before destroying compartments in js shell. r=jandem

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/8f45877833df