456470 - TM: crash in password manager tests

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Robert Sayre]

make -C $OBJDIR/toolkit/components/passwordmgr/ check

Comment 1

[Andreas Gal :gal]

We iloop after test5.

<<<<<<<
TEST-PASS | ../../../../_tests/xpcshell-simple/test_passwordmgr/unit/test_storage_legacy_2.js | all tests passed
TEST-PASS | ../../../../_tests/xpcshell-simple/test_passwordmgr/unit/test_storage_legacy_3.js | all tests passed
TEST-PASS | ../../../../_tests/xpcshell-simple/test_passwordmgr/unit/test_storage_legacy_4.js | all tests passed
TEST-PASS | ../../../../_tests/xpcshell-simple/test_passwordmgr/unit/test_storage_legacy_5.js | all tests passed

Comment 2

[Andreas Gal :gal]

We seem to hit this exception too:

Assertion failed: "need a way to EOT now, since this is trace end": 0 (../../../tracemonkey-pull/js/src/nanojit/LIR.cpp:866)

Comment 3

[Andreas Gal :gal]

Thanks to mrbkap.

(gdb) bt
#0  NanoAssertFail () at ../../../tracemonkey-pull/js/src/nanojit/avmplus.cpp:55
#1  0x00373e46 in nanojit::ExprFilter::insGuard (this=0x3f91450, v=nanojit::LIR_xf, c=0xa4014, x=0x3f91d60) at ../../../tracemonkey-pull/js/src/nanojit/LIR.cpp:866
#2  0x003500f7 in nanojit::LirWriter::insGuard (this=0x3f91e80, v=nanojit::LIR_xf, c=0xa4014, x=0x3f91d60) at LIR.h:445
#3  0x00339f6e in TraceRecorder::guard (this=0x3f91d00, expected=true, cond=0xa4014, exitType=nanojit::MISMATCH_EXIT) at ../../../tracemonkey-pull/js/src/jstracer.cpp:1693
#4  0x00342365 in TraceRecorder::guardShapelessCallee (this=0x3f91d00, callee=@0x8ae194) at ../../../tracemonkey-pull/js/src/jstracer.cpp:4692
#5  0x0034468b in TraceRecorder::record_JSOP_CALL (this=0x3f91d00) at ../../../tracemonkey-pull/js/src/jstracer.cpp:4779
#6  0x002a1686 in js_Interpret (cx=0x8b3800) at jsopcode.tbl:166
#7  0x002b43d8 in js_Invoke (cx=0x8b3800, argc=1, vp=0x8aded0, flags=0) at jsinterp.cpp:1324
#8  0x0104a8c8 in nsXPCWrappedJSClass::CallMethod (this=0x75b790, wrapper=0x7d41b0, methodIndex=10, info=0x8b5518, nativeParams=0xbfffc014) at ../../../../../tracemonkey-pull/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1523
#9  0x01042197 in nsXPCWrappedJS::CallMethod (this=0x7d41b0, methodIndex=10, info=0x8b5518, params=0xbfffc014) at ../../../../../tracemonkey-pull/js/src/xpconnect/src/xpcwrappedjs.cpp:565
#10 0x004dc14c in PrepareAndDispatch (self=0x7d4090, methodIndex=10, args=0xbfffc134) at ../../../../../../../tracemonkey-pull/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
#11 0x004dc3e9 in nsXPTCStubBase::Stub10 (this=0x7d4090) at xptcstubsdef.inc:8
#12 0x004dbe69 in NS_InvokeByIndex_P (that=0x7d4090, methodIndex=10, paramCount=2, params=0xbfffc314) at ../../../../../../../tracemonkey-pull/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
#13 0x01050e27 in XPCWrappedNative::CallMethod (ccx=@0xbfffc560, mode=XPCWrappedNative::CALL_METHOD) at ../../../../../tracemonkey-pull/js/src/xpconnect/src/xpcwrappednative.cpp:2393
#14 0x0105b36d in XPC_WN_CallMethod (cx=0x8b3800, obj=0x3956240, argc=1, argv=0x8adec0, vp=0xbfffc67c) at ../../../../../tracemonkey-pull/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1473
#15 0x002b4347 in js_Invoke (cx=0x8b3800, argc=1, vp=0x8adeb8, flags=2) at jsinterp.cpp:1306
#16 0x0028f9b1 in js_Interpret (cx=0x8b3800) at ../../../tracemonkey-pull/js/src/jsinterp.cpp:4991
#17 0x002b2ef9 in js_Execute (cx=0x8b3800, chain=0x17f8e0, script=0x757e60, down=0x0, flags=0, result=0xbfffee38) at jsinterp.cpp:1550
#18 0x00230b33 in JS_ExecuteScript (cx=0x8b3800, obj=0x17f8e0, script=0x757e60, rval=0xbfffee38) at ../../../tracemonkey-pull/js/src/jsapi.cpp:4907
#19 0x000040e7 in ProcessFile (cx=0x8b3800, obj=0x17f8e0, filename=0x0, file=0xa01205a0, forceTTY=1) at ../../../../../tracemonkey-pull/js/src/xpconnect/shell/xpcshell.cpp:713
#20 0x0000425f in Process (cx=0x8b3800, obj=0x17f8e0, filename=0x0, forceTTY=1) at ../../../../../tracemonkey-pull/js/src/xpconnect/shell/xpcshell.cpp:752
#21 0x000049c1 in ProcessArgs (cx=0x8b3800, obj=0x17f8e0, argv=0xbffff0bc, argc=11) at ../../../../../tracemonkey-pull/js/src/xpconnect/shell/xpcshell.cpp:914
#22 0x00005bb6 in main (argc=11, argv=0xbffff0bc, envp=0xbffff0ec) at ../../../../../tracemonkey-pull/js/src/xpconnect/shell/xpcshell.cpp:1462

Comment 4

[Andreas Gal :gal]

    _checkLoginValues : function (aLogin) {
        function badCharacterPresent(l, c) {
            return ((l.formSubmitURL && l.formSubmitURL.indexOf(c) != -1) ||
                    (l.httpRealm     && l.httpRealm.indexOf(c)     != -1) ||
                                        l.hostname.indexOf(c)      != -1  ||
                                        l.usernameField.indexOf(c) != -1  ||
                                        l.passwordField.indexOf(c) != -1);
        }

        // Nulls are invalid, as they don't round-trip well.
        // Mostly not a formatting problem, although ".\0" can be quirky.
        if (badCharacterPresent(aLogin, "\0"))
            throw "login values can't contain nulls";

        // In theory these nulls should just be rolled up into the encrypted
        // values, but nsISecretDecoderRing doesn't use nsStrings, so the
        // nulls cause truncation. Check for them here just to avoid
        // unexpected round-trip surprises.
        if (aLogin.username.indexOf("\0") != -1 ||
            aLogin.password.indexOf("\0") != -1)
            throw "login values can't contain nulls";

        // Newlines are invalid for any field stored as plaintext.
        if (badCharacterPresent(aLogin, "\r") ||
            badCharacterPresent(aLogin, "\n"))
            throw "login values can't contain newlines";

Comment 5

[Andreas Gal :gal]

Reduced testcase:

function x() {
	function a() {
		return true;
	}
	return a();
}

for (var i = 0; i < 10; ++i)
	x();

Comment 6

[Andreas Gal :gal]

Attachment: Make sure JSOP_DEFLOCALFUN pushes the right function object.

Comment 7

[Brendan Eich [:brendan]]

Comment on attachment 340277 [details] [diff] [review]
Make sure JSOP_DEFLOCALFUN pushes the right function object.

>diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
>--- a/js/src/jsinterp.cpp
>+++ b/js/src/jsinterp.cpp
>@@ -5795,16 +5795,19 @@ js_Interpret(JSContext *cx)
> 
>             obj = FUN_OBJECT(fun);
>             if (OBJ_GET_PARENT(cx, obj) != parent) {
>                 obj = js_CloneFunctionObject(cx, fun, parent);
>                 if (!obj)
>                     goto error;
>             }
> 
>+            TRACE_2(DefLocalFunSetSlot, slot, obj);
>+            
>+            

One blank line on either side is enough. r=me with that nit picked, thanks.

/be

Comment 8

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/7e106fd14850

Comment 9

[Bob Clary [:bc] (inactive)]

test landed http://hg.mozilla.org/mozilla-central/rev/dbf0f00e5b9e and cvs