621374 - Assertion failure: v.isNumber() / Crash null-ptr dereference

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

Another christmas present from me, the following code asserts on mc trunk:

options('tracejit');
for (var j = 0; j < 10; ++[ ][2], ++j ) { }

with Assertion failure: v.isNumber(), at ../jstracer.cpp:8649

When continuing after the assertion, the code hits some more asserts and then crashes with a null ptr dereference:

Program received signal SIGSEGV, Segmentation fault.
0x000000000040fa0c in JSObject::getClass (this=0x0) at ../../jsobj.h:387
387         js::Class *getClass() const { return clasp; }
(gdb) bt
#0  0x000000000040fa0c in JSObject::getClass (this=0x0) at ../../jsobj.h:387
#1  0x00000000004e9d77 in js::DefaultValue (cx=0xaa4270, obj=0x0, hint=JSTYPE_NUMBER, vp=0x7fffffffbb80) at ../jsobj.cpp:5601
#2  0x00000000004d6a9b in js::ValueToNumberSlow (cx=0xaa4270, v=..., out=0x7fffffffbc68) at ../jsnum.cpp:1218
#3  0x00000000004321d1 in js::ValueToNumber (cx=0xaa4270, v=..., out=0x7fffffffbc68) at ../jsnum.h:272
#4  0x00000000005c5af9 in js::TraceRecorder::incHelper (this=0xac1280, v=..., v_ins=0xac3f78, v_after=@0x7fffffffbcb8, incr=1) at ../jstracer.cpp:8655
#5  0x00000000005c5838 in js::TraceRecorder::inc (this=0xac1280, v=..., v_ins=@0x7fffffffbd20, incr=1, pre=true) at ../jstracer.cpp:8619
#6  0x00000000005c5e6b in js::TraceRecorder::incElem (this=0xac1280, incr=1, pre=true) at ../jstracer.cpp:8701
#7  0x00000000005d0ef8 in js::TraceRecorder::record_JSOP_INCELEM (this=0xac1280) at ../jstracer.cpp:11556
#8  0x00000000005be95e in js::TraceRecorder::monitorRecording (this=0xac1280, op=JSOP_INCELEM) at ../jsopcode.tbl:165
#9  0x00000000006aa7f7 in js::Interpret (cx=0xaa4270, entryFrame=0x7ffff6abf048, inlineCallCount=0, interpMode=JSINTERP_NORMAL) at ../jsinterp.cpp:2689

Bisect shows:

Changeset 57711: bad
The first bad revision is:
changeset:   57711
user:        Boris Zbarsky <removed>
date:        Thu Nov 04 16:37:44 2010 -0400
summary:     Bug 605858.  Trace inc() for all primitive values, not just numbers.  r=dvander


As this is a regression, nominating for blocker.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix denseArrayElement to follow its contract for holes.

Comment 2

[Boris Zbarsky [:bzbarsky]]

This was a preexisting bug that bug 605858 just exposed.

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 499925 [details] [diff] [review]
Fix denseArrayElement to follow its contract for holes.

>+/*
>+ * When we end up with a hole, read it as undefined, and make sure to
>+ * set addr_ins to null.
>+ */
..12345678901234567890123456789012345678901234567890123456789012345678901234567890

Super-ultra-whatever-nit: we wrap before 80 but your typewriter uses 72 :-P.

/be

Comment 4

[Boris Zbarsky [:bzbarsky]]

Eh.  Emacs C++ mode strikes again...  I'll fix that before pushing.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/tracemonkey/rev/6f0a7cfb06d7

Comment 6

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/6f0a7cfb06d7