Last Comment Bug 700501 - [ObjShrink] "Assertion failure: [infer failure] Missing type for arg 0: <0xf6b0aaa0>," or "Assertion failure: [infer failure] Missing type for arg 0: [0xf6c001c0],"
: [ObjShrink] "Assertion failure: [infer failure] Missing type for arg 0: <0xf6...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: ---
Assigned To: Brian Hackett (:bhackett)
:
Mentors:
: 698944 700464 700471 700480 (view as bug list)
Depends on:
Blocks: jsfunfuzz 630996
  Show dependency treegraph
 
Reported: 2011-11-07 16:19 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:08 PST (History)
3 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch (10.64 KB, patch)
2011-11-08 18:48 PST, Brian Hackett (:bhackett)
luke: review+
Details | Diff | Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-11-07 16:19:25 PST
Function.prototype.__proto__["p"] = 3
c = [].__proto__
c[5] = 3
Namespace.prototype.__proto__[4] = function() {}
gc()
Function("\
    {\
    function f(d) {}\
    for each(let z in[0]) {\
        f(z)\
    }\
    }\
")()

asserts js debug shell on JM changeset 1210706b4576 with -m, -a and -n at Assertion failure: [infer failure] Missing type for arg 0: <0xf6b0aaa0>,

This was found using a combination of jsfunfuzz and jandem's method fuzzer.
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2011-11-07 16:38:05 PST
This may be related:

gc()
Function("\
    {\
    function g(f){}\
    for each(let w in[0,0,0,[]]) {\
        g(w)\
    }\
    }\
")()

Assertion failure: [infer failure] Missing type for arg 0: [0xf6c001c0],
Comment 2 Brian Hackett (:bhackett) 2011-11-08 18:48:29 PST
Created attachment 573059 [details] [diff] [review]
patch

The default 'new' types of certain objects (Object.prototype, Array.prototype, Function.prototype) are required in several places to have unknown property types.  This broke with the object newType changes --- the object's new type is no longer a strong reference, and if it goes away and is recreated then the recreated type did not have unknown property types.  The fix adds a bit to the flags in the prototype's base shape to indicate whether default 'new' types created off the object need unknown properties.

https://hg.mozilla.org/projects/jaegermonkey/rev/493d52c0a104
Comment 3 Brian Hackett (:bhackett) 2011-11-08 18:54:14 PST
*** Bug 700471 has been marked as a duplicate of this bug. ***
Comment 4 Brian Hackett (:bhackett) 2011-11-08 18:54:33 PST
*** Bug 700480 has been marked as a duplicate of this bug. ***
Comment 5 Brian Hackett (:bhackett) 2011-11-08 18:55:00 PST
*** Bug 700464 has been marked as a duplicate of this bug. ***
Comment 6 Brian Hackett (:bhackett) 2011-11-08 18:59:20 PST
*** Bug 698944 has been marked as a duplicate of this bug. ***
Comment 7 Luke Wagner [:luke] 2011-11-16 11:42:03 PST
Comment on attachment 573059 [details] [diff] [review]
patch

Review of attachment 573059 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsinfer.cpp
@@ +5740,5 @@
> +    JSCompartment::NewTypeObjectSet &table = compartment()->newTypeObjects;
> +    if (table.initialized()) {
> +        JSCompartment::NewTypeObjectSet::Ptr p = table.lookup(this);
> +        if (p)
> +            MarkTypeObjectUnknownProperties(cx, *p);

if (JSCompartment::NewTypeObjectSet::Ptr p = ...)

::: js/src/jsobj.h
@@ +833,5 @@
> +    /*
> +     * Mark an object as requiring its default 'new' type to have unknown
> +     * properties. This is set for a few builtins like Object.prototype and
> +     * Array.prototype; several places in the VM require that the default
> +     * type for these objects have unknown contents.

Could you explain in more detail why some places in the VM requires this?  If its a dirty hack, you could point to the dependent sites which should have explanatory comments; if its a general invariant, you could describe it.
Comment 8 Christian Holler (:decoder) 2013-01-14 08:08:40 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug700501.js.

Note You need to log in before you can comment on or make changes to this bug.