647657 - TI: Crash [@ JSObject::getParent] in testcase involving Function and Array

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Function("var{}=Array()")()

crashes js opt and debug shell on JM changeset a58525f1f4be with -m, -a and -d on Windows 7.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Top 5 lines of backtrace:

#0  0x0805a314 in JSObject::getParent (this=0x0) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-65060-a58525f1f4be/compilePath/jsobj.h:731
#1  0x08161663 in JSObject::getGlobal (this=0x0) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-65060-a58525f1f4be/compilePath/jsobj.cpp:6693
#2  0x0815b2ad in js_GetClassObject (cx=0x84e62a0, obj=0x0, key=JSProto_Array, objp=0xffff45c8) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-65060-a58525f1f4be/compilePath/jsobj.cpp:4347
#3  0x082d2353 in js::mjit::Compiler::callArrayBuiltin (this=0xffff8e54, argc=0, callingNew=false) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-65060-a58525f1f4be/compilePath/methodjit/Compiler.cpp:3627
#4  0x082d0c1f in js::mjit::Compiler::inlineCallHelper (this=0xffff8e54, callImmArgc=0, callingNew=false)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-65060-a58525f1f4be/compilePath/methodjit/Compiler.cpp:3267

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   65054:42f282c4922c
user:        Brian Hackett
date:        Sun Apr 03 14:37:50 2011 -0700
summary:     [INFER] Don't discard JIT code for the topmost frame while recompiling, bug 647424.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Crashes near js_GetClassObject in opt shell.

Comment 4

[Brian Hackett [Laid off!]]

The recent callArrayBuiltin optimization should only be used in compileAndGo scripts, as it is baking in the script's Array.prototype object.

http://hg.mozilla.org/projects/jaegermonkey/rev/dc3bb73615dd

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug647657.js.