504632 - Crash [@ js_NewObjectWithGivenProto] with js1_6/extensions/regress-456826.js

Status: VERIFIED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

crash tracemonkey shell  js1_6/extensions/regress-456826.js

#0  0x000ab519 in js_NewObjectWithGivenProto (cx=0x80f000, clasp=0x1c77e0, proto=0x2c0000, parent=0x2c1980, objectSize=0) at ../jsobj.cpp:2093
#1  0x000ad3b7 in js_NewObject (cx=0x80f000, clasp=0x1c77e0, proto=0x2c0000, parent=0x2c1980, objectSize=0) at ../jsobj.cpp:2182
#2  0x0005fd2e in js_NewFunction (cx=0x80f000, funobj=0x0, native=0x1c7e00 <math_atan_trcinfo>, nargs=1, flags=10240, parent=0x2c1980, atom=0x2c637c) at ../jsfun.cpp:2438
#3  0x00060fa9 in js_DefineFunction (cx=0x80f000, obj=0x2c1980, atom=0x2c637c, native=0x1c7e00 <math_atan_trcinfo>, nargs=1, attrs=10240) at ../jsfun.cpp:2573
#4  0x0001d734 in JS_DefineFunction (cx=0x80f000, obj=0x2c1980, name=0x1b0111 "atan", call=0x1c7e00 <math_atan_trcinfo>, nargs=1, attrs=14336) at ../jsapi.cpp:4627
#5  0x00020998 in JS_DefineFunctions (cx=0x80f000, obj=0x2c1980, fs=0x1c7f80) at ../jsapi.cpp:4609
#6  0x000a1894 in js_InitMathClass (cx=0x80f000, obj=0x2c1000) at ../jsmath.cpp:801
#7  0x0001932c in JS_ResolveStandardClass (cx=0x80f000, obj=0x2c1000, id=2896020, resolved=0xbfffe8cc) at ../jsapi.cpp:1603
#8  0x0000a73d in global_resolve (cx=0x80f000, obj=0x2c1000, id=2896020, flags=0, objp=0xbfffe934) at ../../shell/js.cpp:4334
#9  0x000ac499 in js_LookupPropertyWithFlags (cx=0x80f000, obj=0x2c1000, id=2896020, flags=0, objp=0xbfffe9b0, propp=0xbfffe9ac) at ../jsobj.cpp:3847
#10 0x000b01f9 in js_FindPropertyHelper (cx=0x80f000, id=2896020, cacheResult=1, objp=0xbfffedcc, pobjp=0xbfffedc8, propp=0xbfffedac) at ../jsobj.cpp:3988
#11 0x000882cc in js_Interpret (cx=0x80f000) at ../jsinterp.cpp:5314
#12 0x0009afc4 in js_Execute (cx=0x80f000, chain=0x2c1000, script=0x312a60, down=0x0, flags=0, result=0x0) at jsinterp.cpp:1635
#13 0x0001e3b8 in JS_ExecuteScript (cx=0x80f000, obj=0x2c1000, script=0x312a60, rval=0x0) at ../jsapi.cpp:5048
#14 0x000081d1 in Process (cx=0x80f000, obj=0x2c1000, filename=0xbffff5ee "regress-456826.js", forceTTY=0) at ../../shell/js.cpp:408
#15 0x0000989a in ProcessArgs (cx=0x80f000, obj=0x2c1000, argv=0xbffff484, argc=9) at ../../shell/js.cpp:748
#16 0x0000aeb0 in main (argc=9, argv=0xbffff484, envp=0xbffff4ac) at ../../shell/js.cpp:4752

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

fwiw, I'm having reproducing the crash here. bc, what revision of tracemonkey is that stack against?

Comment 2

[Bob Clary [:bc] (inactive)]

the stack was from an older build, but I just bisected on the SIGBUS and confirmed that on the tip. I'll get a fresh stack in a moment.

regression changeset: 30297:b0f849609c10 user: Andreas Gal <[e-mail]> date: Tue Jul 14 17:06:09 2009 -0700 summary: Avoid integer division in NewGCThing path (503157, r=jwalden).

Comment 3

[Andreas Gal :gal]

Thats bad. Could someone backout the patch? And I will try to reproduce in the meantime.

Comment 4

[Bob Clary [:bc] (inactive)]

PS. the crash was debug only.

Comment 5

[Andreas Gal :gal]

Oh. Ok in that case leave it in. I will look at the assert. I have a browser running with the patch, so TM tip shouldn't be unuseable.

Comment 6

[Andreas Gal :gal]

This works for me in the shell. Are you sure you have a clean build? The line number doesn't match up with an assert in TM tip, and the nearest assert is obviously not failing (it says !objectSize, which is the case here).

Comment 7

[Bob Clary [:bc] (inactive)]

Pretty sure. It's not an assert but a SIGBUS error. I just did a fresh build and reproduced it again.

Comment 9

[Bob Clary [:bc] (inactive)]

update crash bugs to critical per guidelines.

Comment 10

[Wayne Mery (:wsmwk)]

bc, can you still reproduce?

I ask, because it looks like js_NewObjectWithGivenProto doesn't exist on crash stats for 4.0 or newer.

There is however, JS_NewObjectWithGivenProto
https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=JS_NewObjectWithGivenProto&reason_type=contains&date=06%2F01%2F2011%2014%3A00%3A30&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=JS_NewObjectWithGivenProto

Comment 11

[Bob Clary [:bc] (inactive)]

(In reply to comment #10)

> I ask, because it looks like js_NewObjectWithGivenProto doesn't exist on
> crash stats for 4.0 or newer.

I don't understand considering the non-null nature of the crash-stats query you gave.

The test passes nightly debug shell produced as part of the Firefox build in mac os x 10.4, winxp, linux 32bit and 64bit. I would say this bug as filed is now wfm.

Comment 12

[Wayne Mery (:wsmwk)]

(In reply to comment #11)
> (In reply to comment #10)
> 
> > I ask, because it looks like js_NewObjectWithGivenProto doesn't exist on
> > crash stats for 4.0 or newer.
> 
> I don't understand considering the non-null nature of the crash-stats query
> you gave.

the URL is for a _different_ signature JS_..., not js_...


> The test passes nightly debug shell produced as part of the Firefox build in
> mac os x 10.4, winxp, linux 32bit and 64bit. I would say this bug as filed
> is now wfm.


WFM per comment 11

Comment 13

[Bob Clary [:bc] (inactive)]

(In reply to comment #12)

> the URL is for a _different_ signature JS_..., not js_...

doh!