Last Comment Bug 724788 - IonMonkey: Crash [@ js::FindPropertyHelper] or "Assertion failure: shape_,"
: IonMonkey: Crash [@ js::FindPropertyHelper] or "Assertion failure: shape_,"
Status: RESOLVED FIXED
: assertion, crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: ---
Assigned To: David Anderson [:dvander]
:
Mentors:
: 724784 (view as bug list)
Depends on:
Blocks: jsfunfuzz IonFuzz 630996
  Show dependency treegraph
 
Reported: 2012-02-06 22:20 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:14 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (11.55 KB, text/plain)
2012-02-06 22:20 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
fix (71 bytes, patch)
2012-02-17 19:16 PST, David Anderson [:dvander]
no flags Details | Diff | Review
this time with more qref (2.19 KB, patch)
2012-02-17 19:17 PST, David Anderson [:dvander]
jdemooij: review+
Details | Diff | Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-02-06 22:20:17 PST
Created attachment 594917 [details]
stack

o0 = TypeError.prototype.__proto__
o1 = Proxy.create({})
o13 = {}.__proto__
var o15 = Object.prototype
o31 = (new Uint32Array(100)).buffer
function f2(o) {
  try {
    ({
      x: [eval("o")][0]
    }.x.__defineGetter__("toString", function() {
      return o26;
    }));
  } catch (e) {}
}
function f3(o) {
  try {
    +o31
  } catch (e) {}
}
function f19(o) {
  for (var x in eval("o")) {
    eval("o")[x];
  }
}
f2(o15)
f3(o0)
f19(o13)

asserts js debug shell on IonMonkey changeset f46cfb199e77 with -m, --ion, --ion-eager and -n at Assertion failure: shape_, and crashes js opt shell at js::FindPropertyHelper
Comment 1 David Anderson [:dvander] 2012-02-08 16:48:32 PST
The bug here is that the initial snapshot captures the result of MFunctionEnvironment, but if we bail out in the type check prologue, this instruction hasn't been run yet.
Comment 2 Jan de Mooij [:jandem] 2012-02-16 02:23:59 PST
(In reply to David Anderson [:dvander] from comment #1)
> The bug here is that the initial snapshot captures the result of
> MFunctionEnvironment, but if we bail out in the type check prologue, this
> instruction hasn't been run yet.

I just reduced Kraken crypto-ccm again and I'm pretty sure it's crashing due to this bug.
Comment 3 David Anderson [:dvander] 2012-02-17 19:16:29 PST
Created attachment 598469 [details] [diff] [review]
fix

Unfortunately we still crash elsewhere in Kraken, but this appears to fix this bug and crypto-ccm. This is extremely gross though so I'm going to file a follow-up bug on a new opcode.
Comment 4 David Anderson [:dvander] 2012-02-17 19:17:04 PST
Created attachment 598471 [details] [diff] [review]
this time with more qref
Comment 5 Jan de Mooij [:jandem] 2012-02-18 02:07:40 PST
Comment on attachment 598471 [details] [diff] [review]
this time with more qref

I applied this fix to latest tip and Kraken now runs without crashing here, both x86 and x64.
Comment 6 David Anderson [:dvander] 2012-02-21 15:13:37 PST
https://hg.mozilla.org/projects/ionmonkey/rev/82c6ca0616d0
Comment 7 David Anderson [:dvander] 2012-02-21 15:15:20 PST
*** Bug 724784 has been marked as a duplicate of this bug. ***
Comment 8 Christian Holler (:decoder) 2013-01-14 08:14:57 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug724788.js.

Note You need to log in before you can comment on or make changes to this bug.