TI: Assertion failure: a->isProxy() && b->isProxy(), at jsobj.cpp:3654

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Assigned: bhackett)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
This is causing test failures on Mochitest-1 and Mochitest-other. 

I *think* this was introduced by bug 648321, objects a and b have different size. a is a proxy and b is a text node object.
(Reporter)

Comment 1

6 years ago
Created attachment 526818 [details]
Stack
(Assignee)

Comment 2

6 years ago
Is object 'b' a non-native?  TradeGuts should work the same on both proxies and other non-natives so that assertion could just be weakened (no assertions in this area of the code at all when made the change IIRC, and looking at immediate callers was not enlightening).

Looking at this code again, this swap code from the bug 648321 patch is a total trainwreck.

- The numbers of fixed slots are swapped along with everything else (worked back when fixed slots were determined from the arena).
- We reuse the dynamic slots from the other object, but if that object had more fixed slots then the allocated size of its slots pointer will be smaller and we end up with buffer overflows (eeek!).
- After the capacity stuff gets fixed, we also need to clear slots above the other object's numSlots() with undefined.
(Assignee)

Updated

6 years ago
Assignee: general → bhackett1024
(Reporter)

Comment 3

6 years ago
(In reply to comment #2)
> Is object 'b' a non-native?

js_DumpObject:

object 0x1b4aa460
class 0x1c8c4cf4 Text
flags:
proto <XPC_WN_ModsAllowed_NoCall_Proto_JSClass object at 0x1b4aa3b8>
parent <HTMLDocument object at 0x1b4aa2d8>
private 0x1c4ca120
reserved slots:
   0 (reserved) = undefined
properties:
(Assignee)

Updated

6 years ago
Blocks: 648321

Comment 4

6 years ago
If you fix stuff here please separate and land directly on TM.
(Assignee)

Comment 5

6 years ago
These problems are with a patch that is up for review in bug 648321 and hasn't landed on TM yet.  The implementation of TradeGuts in TM currently is I think fine, but 648321 changes how objects are laid out and had to change this function.

I thought that at least when bug 584917 landed this situation wasn't possible (swap a non-native with a native outside of FixProxy), but it looks like that's changed.  It shouldn't be hard to handle this case though, we just need to make sure that any native object whose guts are swapped with one of different size is reshaped afterwards.
(Assignee)

Comment 6

6 years ago
This should fix things.

http://hg.mozilla.org/projects/jaegermonkey/rev/425b3fcdbe41
(Assignee)

Updated

6 years ago
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.