1902907 - Assertion failure: startOfUninitialized <= nfixed, at jit/MacroAssembler.cpp:922

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P2)

Description

[Nils Bars]

Attachment: bug.js

Steps to reproduce:

Checkout commit 97eeb1c55a5c73bd3938d4899685321a7967333b and invoke the js shell as follows:

js --fuzzing-safe  <testcase>

Actual results:

Assertion failure: startOfUninitialized <= nfixed, at jit/MacroAssembler.cpp:922

Comment 1

[Jan de Mooij [:jandem]]

Reduced test below.

// --fast-warmup --no-threads
Object.defineProperty(RegExp.prototype, "flags", {get: function() {
    Array.prototype.push.call(this);
}});
function f() {
    var s = disassemble();
    for (var i = 0; i < 200; i++) {
        s.replace(/0./);
    }
}
f();

Comment 2

[Jan de Mooij [:jandem]]

Oh this is creative. The disassemble() call ends up calling ValueToSource on the script's template RegExp object. Unfortunately this can have side-effects, in this case it invokes our custom flags getter and this messes up the template object enough to confuse codegen later.

disassemble is a testing function that's not exposed to normal JS code.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/6b239eb7bae6
user:        Tooru Fujisawa
date:        Tue Aug 02 13:56:27 2022 +0000
summary:     Bug 1782166 - Part 1: Add JSScript::dump and move shell dis() function implementation into it. r=nbp

Jan, would bug 1782166 be a likely regressor, since you're already working on it?

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1782166

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Bug 1902907 - Don't leak template RegExpObject to JS through 'disassemble' testing function. r?arai!

Call ToDisassemblySource instead of ValueToSource because it handles this without
calling into JS.

The JSOp::Object and JSOp::CallSiteObj objects can have a similar issue, but these
objects are already exposed to script so aren't affected the same way. I tried to add
a special mode to ValueToSource to handle these objects too without running JS, but it
got too complicated for this testing function issue.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/09d29cf7128f
Don't leak template RegExpObject to JS through 'disassemble' testing function. r=arai

Comment 7

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/09d29cf7128f

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:jandem, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox128 to wontfix.

For more information, please visit BugBot documentation.