Last Comment Bug 700295 - Crash at its_getter
: Crash at its_getter
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: 11 Branch
: x86_64 Linux
: -- critical (vote)
: mozilla11
Assigned To: Brian Hackett (:bhackett)
:
Mentors:
: 688371 693045 (view as bug list)
Depends on:
Blocks: infer-regress langfuzz
  Show dependency treegraph
 
Reported: 2011-11-07 07:14 PST by Christian Holler (:decoder)
Modified: 2013-02-07 05:19 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch (95d98e8ab9f3) (3.28 KB, patch)
2011-11-09 08:21 PST, Brian Hackett (:bhackett)
jwalden+bmo: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2011-11-07 07:14:56 PST
The following testcase asserts on jaegermonkey branch revision 1210706b4576 (run with -m -n -a), tested on 64 bit:


this.__proto__ = null;
Object.prototype.__proto__ = this;
function exploreProperties(obj) {
  var props = [];
  for (var o = obj; o; o = Object.getPrototypeOf(o)) {
    props = props.concat(Object.getOwnPropertyNames(o));
  }
  for (var i = 0; i < props.length; ++i) {
    var p = props[i];
    var v = obj[p];
  }
}
var c = [{}];
exploreProperties(c);
Comment 1 Brian Hackett (:bhackett) 2011-11-09 08:09:42 PST
This testcase crashes on m-i cset e05e46646dc3.

its_getter and its_setter (PropertyOp hooks only defined in the shell) do not have checks that they are being called on the right object, and will go straight to the object's private data.  The accessed object is an array; this crashes on JM because on JM arrays do not have private data, and crashes on trunk because the array private data is an integer (array length) rather than a pointer (as expected by the hook).
Comment 2 Brian Hackett (:bhackett) 2011-11-09 08:21:53 PST
Created attachment 573207 [details] [diff] [review]
patch (95d98e8ab9f3)

I guess this is the right fix, though I don't know how the PropertyOp API works so well.
Comment 3 Jeff Walden [:Waldo] (remove +bmo to email) 2011-11-09 18:17:26 PST
Comment on attachment 573207 [details] [diff] [review]
patch (95d98e8ab9f3)

Review of attachment 573207 [details] [diff] [review]:
-----------------------------------------------------------------

I wonder how many of the bugs related to the its class are bugs due to its buggy implementation, versus bugs that reveal actual problems.
Comment 4 Jeff Walden [:Waldo] (remove +bmo to email) 2011-11-09 18:18:38 PST
I feel like at some point I wrote comment 1 in another bug, then nobody acted on it because it wasn't an actual bug, and it got rediscovered here in a somewhat different manner.  But I might be wrong about that.  :-\
Comment 5 Brian Hackett (:bhackett) 2011-11-09 19:33:19 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/c2ed79d6fea9
Comment 6 Christian Holler (:decoder) 2011-11-10 02:55:24 PST
*** Bug 688371 has been marked as a duplicate of this bug. ***
Comment 7 Marco Bonardo [::mak] 2011-11-10 03:28:42 PST
https://hg.mozilla.org/mozilla-central/rev/c2ed79d6fea9
Comment 8 Christian Holler (:decoder) 2012-10-02 08:36:16 PDT
*** Bug 693045 has been marked as a duplicate of this bug. ***
Comment 9 Christian Holler (:decoder) 2013-02-07 05:19:17 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397

Note You need to log in before you can comment on or make changes to this bug.