743000 - Crash [@ JSCompartment::wrap] or [@ TypedArrayTemplate<int>::copyFromTypedArray] or "Assertion failure: IsFastOrSlowTypedArray(obj),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Int32Array(wrap(new Uint8ClampedArray))

asserts js debug shell on m-c changeset 1da11a2bc5db without any CLI flags at Assertion failure: IsFastOrSlowTypedArray(obj), and crashes js opt shell at TypedArrayTemplate<int>::copyFromTypedArray

s-s just to be safe, this might be related to bug 736609. A shell compiled with the patch in bug 736609 still shows this assert.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   91040:17e95355ad77
user:        Bobby Holley
date:        Thu Apr 05 09:39:41 2012 +1000
summary:     Bug 737245 - Typed Arrays should handle cross-compartment wrappers; part3. r=luke

Comment 2

[Bobby Holley (:bholley)]

This stuff has been taken over by sfink and markh. I didn't land the patches (though I wrote them a while back), so I'm not really in the loop here.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This also crashes as JSCompartment::wrap on Mac with another testcase:

evalcx("wrap(new Uint8ClampedArray).buffer;", newGlobal("new-compartment"));

Comment 4

[Steve Fink [:sfink] [:s:]]

I think this should be fixed with bug 741041, though I'll need to check to be sure. It's definitely the sort of thing that I'm trying to fix. Thanks!

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I've found a version that crashes at js::GCMarker::drainMarkStack, so I'm quite sure this can be [sg:critical].

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Steve Fink [:sfink] from comment #4)
> I think this should be fixed with bug 741041, though I'll need to check to
> be sure. It's definitely the sort of thing that I'm trying to fix. Thanks!

Bug 741041 should land in Firefox 14, else the regressor of this bug needs to be backed out.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Second testcase stack

> I've found a version that crashes at js::GCMarker::drainMarkStack, so I'm
> quite sure this can be [sg:critical].

Function("b = wrap(Float64Array()).buffer")()
gc()

I've attached the backtrace for this testcase. This testcase accesses weird memory address 0xebe04511.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> Function("b = wrap(Float64Array()).buffer")()
> gc()

This also asserts 32-bit js debug shell on mozilla-central changeset 434f50e70815 without any CLI arguments at Assertion failure: IsFastOrSlowTypedArray(obj)

Comment 9

[Steve Fink [:sfink] [:s:]]

(In reply to Steve Fink [:sfink] from comment #4)
> I think this should be fixed with bug 741041, though I'll need to check to
> be sure. It's definitely the sort of thing that I'm trying to fix. Thanks!

I was wrong. Bug 711843 fixes this.

The problem is that eg prop_getBuffer() calls js_IsTypedArray() that, as of the patch identified in comment 1, unconditionally unwraps its argument. This is wrong in all kinds of ways. I could probably come up with a spot fix that partially rolled back that patch, but bug 711843 restructures the code flow so it's easy to only unwrap on the paths that need it.

If I can't get bug 711843 landed in the next few days, I'll work on a spot fix.

Comment 10

[David Bolter [:davidb] (NeedInfo me for attention)]

(In reply to Steve Fink [:sfink] from comment #9)
> (In reply to Steve Fink [:sfink] from comment #4)
> If I can't get bug 711843 landed in the next few days, I'll work on a spot
> fix.

Sounds like a plan :) (Assigning this one to you)

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Confirming fixed by bug 743000 (http://hg.mozilla.org/mozilla-central/rev/7a601537cb88)

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   92092:7a601537cb88
user:        Tom Schuster
date:        Sat Jan 14 09:43:00 2012 -0800
summary:     Bug 711843 - Update JSAPI for typed arrays, remove uses of jstypedarray.h outside the engine [r=Waldo,bz,Ms2ger,bholley,bjacob,philikon,evilpie,bent,yourmama] [a=mfinkle thanks to gkw]

Comment 12

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 13

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929