705895 - [ObjShrink] Crash with testcase at weird location (likely null deref)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

c = (0).__proto__
function f(o) {
    o.__proto__ = null
    for (x in o) {}
}
for (i = 0; i < 9; i++) {
    f(c)
    Function.prototype.__proto__.__proto__ = c
    for (x in Function.prototype.__proto__) {}
    f(Math.__proto__)
}

crashes js debug shell on JM changeset 5546f57c9567 with -m at an unknown location, but likely a null deref (see the weird stack).

function f(o) {
    for (j = 0; j < 9; j++) {
        if (j) {
            o.__proto__ = null
        }
        for (v in o) {}
    }
}
for (i = 0; i < 9; i++) {
    (new Boolean).__proto__.__defineGetter__("toString", function() {})
    f(Boolean.prototype)
}

is another testcase which crashes weirdly, but with -m and -a.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   80261:fedf9dae8db5
user:        Brian Hackett
date:        Fri Nov 18 13:28:07 2011 -0800
summary:     Mark uncacheable prototypes on objects whose prototype has dynamically changed, bug 703047.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Two related problems.  First, marking an object as having an uncacheable proto did not guarantee a shape change for dictionaries.  Second, entries in the native iterator cache could be generated for objects with uncacheable protos.  I also noticed a third problem, which is that shape accesses when checking for a match on the last native iterator were doing 32 bit rather than pointer-size loads and compares.

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/projects/jaegermonkey/rev/1e8c03ba91d0

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This eventually landed on m-c:

http://hg.mozilla.org/mozilla-central/rev/1e8c03ba91d0

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug705895-1.js.