580712 - JM: Crash [@ js::DefaultValue] or "Assertion failure: &obj != NULL,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

__defineSetter__("x", function () {})
try {
    print(x = function () {})
} catch (e) {}

asserts js debug shell on JM changeset 7c6f62fcbd91 with -m at Assertion failure: &obj != NULL, at ../../jsvalue.h:356 and crashes js opt shell at js::DefaultValue.

Program received signal SIGSEGV, Segmentation fault.
0x080c66ee in js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ()
(gdb) bt
#0  0x080c66ee in js::DefaultValue(JSContext*, JSObject*, JSType, js::Value*) ()
#1  0x0000007f in ?? ()
#2  0x08278e89 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) x/i $eip
=> 0x80c66ee <_ZN2js12DefaultValueEP9JSContextP8JSObject6JSTypePNS_5ValueE+238>:	cmp    %edx,0x4(%esi)
(gdb) x/b $edx
0x822da60 <js_StringClass>:	0xe1

Comment 1

[Andrew Drake [:adrake]]

Works for me on moo tip 64-bit, but fails on 32-bit.

Comment 2

[Andrew Drake [:adrake]]

Works for me on 32-bit with ICs disabled.

Comment 3

[Andrew Drake [:adrake]]

The MIC-ified implementation of JSOP_SETGNAME is correctly using the known type of the new value of x (OBJECT), but is incorrectly using the return value of the setter. This leads to the return value of the setter (i.e., undefined) being coerced to an OBJECT with predictable results later (return a non-zero integer from the setter and you'll crash/dereference arbitrary memory because it's not NULL).

Comment 4

[Luke Wagner [:luke]]

The same "using the result of the setter" mistake is in TM tip (introduced by fatvals).  Thus, the fixes in bug 582162 need to be propagated to the JM stub calls.

Comment 5

[Andrew Drake [:adrake]]

Attachment: Patch

Incorporates changes in bug mentioned in luke's comment.

Comment 6

[Andrew Drake [:adrake]]

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/e0988eae6c08

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug580712.js.