724788 - IonMonkey: Crash [@ js::FindPropertyHelper] or "Assertion failure: shape_,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

o0 = TypeError.prototype.__proto__
o1 = Proxy.create({})
o13 = {}.__proto__
var o15 = Object.prototype
o31 = (new Uint32Array(100)).buffer
function f2(o) {
  try {
    ({
      x: [eval("o")][0]
    }.x.__defineGetter__("toString", function() {
      return o26;
    }));
  } catch (e) {}
}
function f3(o) {
  try {
    +o31
  } catch (e) {}
}
function f19(o) {
  for (var x in eval("o")) {
    eval("o")[x];
  }
}
f2(o15)
f3(o0)
f19(o13)

asserts js debug shell on IonMonkey changeset f46cfb199e77 with -m, --ion, --ion-eager and -n at Assertion failure: shape_, and crashes js opt shell at js::FindPropertyHelper

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

The bug here is that the initial snapshot captures the result of MFunctionEnvironment, but if we bail out in the type check prologue, this instruction hasn't been run yet.

Comment 2

[Jan de Mooij [:jandem]]

(In reply to David Anderson [:dvander] from comment #1)
> The bug here is that the initial snapshot captures the result of
> MFunctionEnvironment, but if we bail out in the type check prologue, this
> instruction hasn't been run yet.

I just reduced Kraken crypto-ccm again and I'm pretty sure it's crashing due to this bug.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Unfortunately we still crash elsewhere in Kraken, but this appears to fix this bug and crypto-ccm. This is extremely gross though so I'm going to file a follow-up bug on a new opcode.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: this time with more qref

Comment 5

[Jan de Mooij [:jandem]]

Comment on attachment 598471 [details] [diff] [review]
this time with more qref

I applied this fix to latest tip and Kraken now runs without crashing here, both x86 and x64.

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

https://hg.mozilla.org/projects/ionmonkey/rev/82c6ca0616d0

Comment 8

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug724788.js.