470223 - TM: Crash when typing in location bar, jit.chrome=true @ js_NewObjectWithGivenProto

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Ed Lee :Mardak]

Stack looks like..

0	js_NewObjectWithGivenProto
1	js_NewObject
2	js_NewArrayObject
3	array_slice
4	js_Interpret
5	js_Invoke
6	js_InternalInvoke
7	JS_CallFunctionValue

So perhaps it's not |let| scope causing problems but now that we trace it, we run into an issue with something else?

Comment 1

[Ed Lee :Mardak]

The only thing with a "let (block) expression;" in the location bar is..

regions = regions.sort(function(a, b) let (start = a[0] - b[0])
  start == 0 ? a[1] - b[1] : start);

http://hg.mozilla.org/mozilla-central/file/d2c8c9456549/toolkit/content/widgets/autocomplete.xml#l1279

But if it can be any plain let declaration, there are many. So assuming it's slice causing the problem, there should be only one:

return boundaries.slice(1);

http://hg.mozilla.org/mozilla-central/file/d2c8c9456549/toolkit/content/widgets/autocomplete.xml#l1313

Comment 2

[Ed Lee :Mardak]

Attachment: not really reduced testcase

Here's the function pulled out of autocomplete.xml, but I'm not 100% sure it's the thing that's actually causing the crash. But it is causing wierdness..

When running OPT builds, the third iteration (5th call to _getBoundaryIndices) seems to result in either..

TypeError: Math is null
TypeError: Math.max is not a function
TypeError: print is not a function

./Darwin_OPT.OBJ/js -j getBoundary.js 
0,11,12,23 1,16,17,26,27,41
0,11,12,23 1,16,17,26,27,41
TypeError: print is not a function

debug builds show..
./Darwin_DBG.OBJ/js -j getBoundary.js
0,11,12,23 1,16,17,26,27,41
Assertion failure: StackBase(fp) + blockDepth == regs.sp, at jsinterp.cpp:6834
Trace/BPT trap

Comment 3

[Ed Lee :Mardak]

Attachment: reduced testcase

I haven't been able to reduce this any more.. but the first call results in R being [0], while the second call results in R being [0,1].

Running it results in..
Assertion failure: blockDepth <= StackDepth(script), at jsinterp.cpp:6809
Trace/BPT trap

Comment 4

[Ed Lee :Mardak]

Somewhat smaller, but basically the same as attachment 353689 [details]

function F(A) {
  for (R = [], s = 0; (m = A.indexOf("m", s++)) >= 0; )
    R.push([m]);
  for (i = R.length; i--; ) {
    let r = R[i];
    if (r[0]);
  }
}
F("m"); F("mm");

To cause problems..
1) |F| must be called with 2 different values
2) |R.push([m])| needs to push |m| (and not a constant)
2.1) R.push([A.indexOf(...]) doesn't trigger the problem
3) |r| needs to be declared with |let|
4) |if (r[0])| needs to be there (but could be !r[0])

Not sure if indexOf is required.. but I tried replacing the first loop with a plain loop that pushes 0, 1. Or passing in [0], [0,1] for A and have it push/copy that into R. Those didn't work.

Comment 5

[Régis Caspar]

I get this crash too on Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20081218 Minefield/3.2a1pre ID:20081218035829

some bp : bp-a3b001df-03b7-428e-9a5f-774d42081218, bp-5545c232-5bbc-4c87-bd49-852e52081218

Comment 6

[Ed Lee :Mardak]

Normally you would just go to about:config and switch jit.chrome to false, but that's kinda hard to do if typing in the location bar crashes the browser ;)

Workaround:
1) Open Preferences -> Privacy -> History -> Suggest: "Nothing"
2) about:config into the location bar
3) Search for "jit" and double click javascript.options.jit.chrome to false
4) Reset Preferences -> Privacy -> History -> Suggest: "History & Bookmarks"

Comment 7

[Régis Caspar]

Thanks I already did :) 
But it's a good idea to put the workaround in the bug.

Comment 8

[Emanuel Hoogeveen [:ehoogeveen]]

copy/pasting about:config into the location bar works as well (except if this still leaves more than one possibility?)

Comment 9

[Brendan Eich [:brendan]]

I bet the fix will show up in bug 470300.

/be

Comment 10

[Ed Lee :Mardak]

The reduced testcase from comment #4 doesn't assert anymore, so the location bar crash should be gone.

Comment 12

[Régis Caspar]

Verified fixed on Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20081219 Minefield/3.2a1pre ID:20081219034805

Comment 13

[:Gavin Sharp [email: [e-mail]]]

WFM on 1.9.1 tip, fixed1.9.1 per bug 470300 comment 8.

Comment 14

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/1f9f85340743
/cvsroot/mozilla/js/tests/js1_7/regress/regress-470223.js,v  <--  regress-470223.js
initial revision: 1.1

Comment 15

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2