The default bug view has changed. See this FAQ.

[ObjShrink] Crash with testcase at weird location (likely null deref)

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
x86
Linux
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 577381 [details]
stack

c = (0).__proto__
function f(o) {
    o.__proto__ = null
    for (x in o) {}
}
for (i = 0; i < 9; i++) {
    f(c)
    Function.prototype.__proto__.__proto__ = c
    for (x in Function.prototype.__proto__) {}
    f(Math.__proto__)
}

crashes js debug shell on JM changeset 5546f57c9567 with -m at an unknown location, but likely a null deref (see the weird stack).

function f(o) {
    for (j = 0; j < 9; j++) {
        if (j) {
            o.__proto__ = null
        }
        for (v in o) {}
    }
}
for (i = 0; i < 9; i++) {
    (new Boolean).__proto__.__defineGetter__("toString", function() {})
    f(Boolean.prototype)
}

is another testcase which crashes weirdly, but with -m and -a.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   80261:fedf9dae8db5
user:        Brian Hackett
date:        Fri Nov 18 13:28:07 2011 -0800
summary:     Mark uncacheable prototypes on objects whose prototype has dynamically changed, bug 703047.
Created attachment 577441 [details] [diff] [review]
patch

Two related problems.  First, marking an object as having an uncacheable proto did not guarantee a shape change for dictionaries.  Second, entries in the native iterator cache could be generated for objects with uncacheable protos.  I also noticed a third problem, which is that shape accesses when checking for a match on the last native iterator were doing 32 bit rather than pointer-size loads and compares.
Assignee: general → bhackett1024
Attachment #577441 - Flags: review?(luke)
https://hg.mozilla.org/projects/jaegermonkey/rev/1e8c03ba91d0
Duplicate of this bug: 705859

Updated

5 years ago
Attachment #577441 - Flags: review?(luke) → review+
(Reporter)

Comment 4

5 years ago
This eventually landed on m-c:

http://hg.mozilla.org/mozilla-central/rev/1e8c03ba91d0
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug705895-1.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.