Last Comment Bug 700295 - Crash at its_getter
: Crash at its_getter
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: 11 Branch
: x86_64 Linux
-- critical (vote)
: mozilla11
Assigned To: Brian Hackett (:bhackett)
: Jason Orendorff [:jorendorff]
: 688371 693045 (view as bug list)
Depends on:
Blocks: infer-regress langfuzz
  Show dependency treegraph
Reported: 2011-11-07 07:14 PST by Christian Holler (:decoder)
Modified: 2013-02-07 05:19 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch (95d98e8ab9f3) (3.28 KB, patch)
2011-11-09 08:21 PST, Brian Hackett (:bhackett)
jwalden+bmo: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2011-11-07 07:14:56 PST
The following testcase asserts on jaegermonkey branch revision 1210706b4576 (run with -m -n -a), tested on 64 bit:

this.__proto__ = null;
Object.prototype.__proto__ = this;
function exploreProperties(obj) {
  var props = [];
  for (var o = obj; o; o = Object.getPrototypeOf(o)) {
    props = props.concat(Object.getOwnPropertyNames(o));
  for (var i = 0; i < props.length; ++i) {
    var p = props[i];
    var v = obj[p];
var c = [{}];
Comment 1 User image Brian Hackett (:bhackett) 2011-11-09 08:09:42 PST
This testcase crashes on m-i cset e05e46646dc3.

its_getter and its_setter (PropertyOp hooks only defined in the shell) do not have checks that they are being called on the right object, and will go straight to the object's private data.  The accessed object is an array; this crashes on JM because on JM arrays do not have private data, and crashes on trunk because the array private data is an integer (array length) rather than a pointer (as expected by the hook).
Comment 2 User image Brian Hackett (:bhackett) 2011-11-09 08:21:53 PST
Created attachment 573207 [details] [diff] [review]
patch (95d98e8ab9f3)

I guess this is the right fix, though I don't know how the PropertyOp API works so well.
Comment 3 User image Jeff Walden [:Waldo] (remove +bmo to email) 2011-11-09 18:17:26 PST
Comment on attachment 573207 [details] [diff] [review]
patch (95d98e8ab9f3)

Review of attachment 573207 [details] [diff] [review]:

I wonder how many of the bugs related to the its class are bugs due to its buggy implementation, versus bugs that reveal actual problems.
Comment 4 User image Jeff Walden [:Waldo] (remove +bmo to email) 2011-11-09 18:18:38 PST
I feel like at some point I wrote comment 1 in another bug, then nobody acted on it because it wasn't an actual bug, and it got rediscovered here in a somewhat different manner.  But I might be wrong about that.  :-\
Comment 5 User image Brian Hackett (:bhackett) 2011-11-09 19:33:19 PST
Comment 6 User image Christian Holler (:decoder) 2011-11-10 02:55:24 PST
*** Bug 688371 has been marked as a duplicate of this bug. ***
Comment 7 User image Marco Bonardo [::mak] 2011-11-10 03:28:42 PST
Comment 8 User image Christian Holler (:decoder) 2012-10-02 08:36:16 PDT
*** Bug 693045 has been marked as a duplicate of this bug. ***
Comment 9 User image Christian Holler (:decoder) 2013-02-07 05:19:17 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.