698871 - [ObjShrink]: GC related crash [@ JSObject::lastProperty] or [@ getObjectParent]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase crashes on jaegermonkey branch revision f951e9151626 (run with -m -n -a), tested on 64 bit.

Comment 1

[Christian Holler (:decoder)]

Backtrace:

==38292== Invalid read of size 8
==38292==    at 0x412EAA: JSObject::lastProperty() const (jsobj.h:482)
==38292==    by 0x4152CD: JSObject::isNative() const (jsobjinlines.h:1121)
==38292==    by 0x52EE47: LookupPropertyWithFlagsInline(JSContext*, JSObject*, jsid, unsigned int, JSObject**, JSProperty**) (jsobj.cpp:5596)
==38292==    by 0x52F04B: js::LookupPropertyWithFlags(JSContext*, JSObject*, jsid, unsigned int, JSObject**, JSProperty**) (jsobj.cpp:5654)
==38292==    by 0x53094B: js_SetPropertyHelper(JSContext*, JSObject*, jsid, unsigned int, JS::Value*, int) (jsobj.cpp:6214)
==38292==    by 0x44D2C8: array_setGeneric(JSContext*, JSObject*, jsid, JS::Value*, int) (jsarray.cpp:931)
==38292==    by 0x529453: JSObject::nonNativeSetProperty(JSContext*, jsid, JS::Value*, int) (jsobj.cpp:3669)
==38292==    by 0x442D1F: JSObject::setGeneric(JSContext*, jsid, JS::Value*, int) (jsobjinlines.h:141)
==38292==    by 0x4F4B91: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:3627)
==38292==    by 0x6F12E5: js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, JS::Value*, bool) (MethodJIT.cpp:1015)
==38292==    by 0x6F1470: CheckStackAndEnterMethodJIT(JSContext*, js::StackFrame*, void*, bool) (MethodJIT.cpp:1046)
==38292==    by 0x6F1553: js::mjit::JaegerShot(JSContext*, bool) (MethodJIT.cpp:1063)
==38292==  Address 0xdadadadadadadada is not stack'd, malloc'd or (recently) free'd

Comment 2

[Christian Holler (:decoder)]

I suspect this bug being the source of many different failures on the JM branch.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Here's another testcase:

for (e in
    eval("\
        (function(){\
            for(x in [0,0]) {\
                try {\
                    let q;\
                    with(gc()) {\
                        for(a in <y>></y>)\
                        yield;\
                        z\
                    }\
                } catch(e){}\
            }\
        })\
    ")()
) {}

crashes js debug shell on JM changeset 1210706b4576 patched with patch v1 from bug 697279 without any CLI flags at JSObject::lastProperty and crashes js opt shell at getObjectParent.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

stacks for testcase in comment 3

Comment 5

[Brian Hackett [Laid off!]]

During array slowification there was an interval where the slowified array appeared to be a newborn, which kept its type from being pinned and led to a later GC crash.  This was fixed by bug 684507, which removes isNewborn from JSObject.