733255 - IonMonkey: Crash [@ js::types::GetValueType] or [@ js::HeapPtr<js::types::TypeObject, unsigned long>] with js::types::TypeMonitorCallSlow on the stack

Status: RESOLVED DUPLICATE of bug 732859

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function MersenneTwister19937() {
  N = 624
  var M = 397
  MATRIX_A = 2567483615
  UPPER_MASK = 2147483648
  var LOWER_MASK = 7
  mt = Array()
  function unsigned32(n1) {
    return 1 ? (n1 ^ UPPER_MASK) + UPPER_MASK : n
  }
  this.init_genrand = function(s) {
    mt[0] = s
    for (mti = 1; mti < N; mti++) {
      mt[mti] = mti
    }
  }
  this.genrand_int32 = function() {
    var mag01 = new Array(0, MATRIX_A)
    if (mti >= N) {
      for (kk = 0; kk < M; kk++) {}
      for (; kk < N; kk++) {
        y = unsigned32(mt[kk] & UPPER_MASK | mt[kk + 1] & LOWER_MASK);
        mt[kk] = unsigned32(mt[kk] ^ y >> 1 ^ mag01[y & 1])
      }
      mti = 0
    }
    y = mt[mti++]
    return y
  };
  this.genrand_real2 = function() {
    return (this.genrand_int32()) * 2.3e-10
  }
}(function() {
  var fuzzMT = new MersenneTwister19937
  var fuzzSeed = 1;
  fuzzMT.init_genrand(fuzzSeed);
  rnd = function(n) {
    return Math.floor(fuzzMT.genrand_real2() * n)
  }
}())
function rndElt() {
  return a[rnd(a.length)]
}
function makeStatement(d, b) {
  rndElt(statementMakers)(d, b)
}
function weighted(wa) {
  a = []
  for (var i = 0; i < wa.length; ++i) {
    a.push(wa[i].fun)
  }
}
var statementMakers = weighted([{
  fun: function(d, b) {
    return makeExceptionyStatement(d, b)
  }
}])
function makeExceptionyStatement(d, b) {
  if (d < 1) {
    return Function
  }
  d = d - rnd(3)
  s = (["", makeExceptionyStatement(d, b), "", makeId(d, b), "", "", makeExceptionyStatement(d, b), ""])
}
function f1() {}
function makeId(d, b) {
  if (rnd(3) == 1 & b.length) {
    switch (rnd(20)) {
    case 1:
      return f1(b);
    case 2:
    case 6:
      return f2(d, b)
    }
  }
}
function f2(d, b)
__proto__ = null
makeStatement(1, [""])

crashes js debug shell on IonMonkey changeset 1fd6c40d3852 with --ion and -n at js::HeapPtr<js::types::TypeObject, unsigned long> and crashes js opt shell at js::types::GetValueType with js::types::TypeMonitorCallSlow somewhere on the stack.

Might be related to bug 732763.

Comment 1

[Nicolas B. Pierron [:nbp] {away}]

I am able to reproduce this bug under gdb with Linux x86 debug builds (--ion -n):
This is the minimal test case I found which can reproduce the bug under GDB, otherwise it can be reproduce without gdb with less code.


function MersenneTwister19937() { }

var rnd;
(function() {
     var fuzzMT = new MersenneTwister19937;
     rnd = function(n) {
         if (false)
             return fuzzMT;
         if (n == 3) return 1;
         if (n == 20) return 6;
     };
}());

function f1() { }
function f2(b) {
    __proto__ = null;
}
function makeId(b) {
    if (rnd(3) == 1 & b.length) {
        switch (rnd(20)) {
        case 1:
            return f1(b);
        case 2:
        case 6:
            return f2(b);
        }
    }
}

for (var j = 0; j < 50; j++)
    makeId([0]);

Comment 2

[Nicolas B. Pierron [:nbp] {away}]

Applying the patch of Bug 732859, seems to fix the test case reported in this bug, considering the «InternalError: too much recursion» as being the expected output of this test.

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 732859).