Last Comment Bug 768446 - crash in CrashIfInvalidSlot
: crash in CrashIfInvalidSlot
Status: RESOLVED FIXED
[firebug-p1]
: crash, reproducible
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Windows NT
: -- critical (vote)
: mozilla16
Assigned To: Luke Wagner [:luke]
:
Mentors:
: 768726 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-26 07:07 PDT by Jan Honza Odvarko [:Honza]
Modified: 2012-08-21 06:19 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
rm StackIter stack sniffing (25.98 KB, patch)
2012-06-28 22:29 PDT, Luke Wagner [:luke]
dvander: review+
Details | Diff | Splinter Review
rm StackIter::sp_ (35.80 KB, patch)
2012-06-28 22:30 PDT, Luke Wagner [:luke]
no flags Details | Diff | Splinter Review
rm StackIter::sp_ (36.10 KB, patch)
2012-06-28 22:35 PDT, Luke Wagner [:luke]
dvander: review+
Details | Diff | Splinter Review

Description Jan Honza Odvarko [:Honza] 2012-06-26 07:07:09 PDT
This bug was filed from the Socorro interface and is 
report bp-0d07b082-130a-4b4e-bee2-f09ad2120626 .
============================================================= 

1) Install Firebug 1.10 b1
http://getfirebug.com/releases/firebug/1.10/firebug-1.10.0b1.xpi
2) Open Firebug F12 and enable all panels (right click on the toolbar button and pick "Enable All Panel")
3) Restart Firefox 
4) Open Firebug, select the Console Panel
5) Execute following in the Command line:
var arr = [];arr.push(arr);console.log(arr);

-> CRASH

---

Somehow related to infinite recursion

Tested with: http://hg.mozilla.org/mozilla-central/rev/5c07a681371d

Honza
Comment 1 Luke Wagner [:luke] 2012-06-26 11:03:37 PDT
Can you get this to reproduce on debug builds or non-windows builds?
Comment 3 Luke Wagner [:luke] 2012-06-26 18:48:30 PDT
Ah, good to know.  I assume this is only with opt builds?
I can't repro with a debug build on win or linux; I'll try an opt build next.

Jan: on a side-note, it seems like Firebug also has a bug here, presumably an infinite recursion caused by the cyclic array being passed to console.log.  Of course the crash should be fixed, but, even after that, FB should be fixed to handle cyclic graphs correctly (by keeping a hash table of visited objects, etc); as is, FB is hanging the browser.  Also: it seems that FB is repeatedly hitting the recursion limit and then catching and ignoring the exception.
Comment 4 Jan Honza Odvarko [:Honza] 2012-06-27 03:42:59 PDT
(In reply to Luke Wagner [:luke] from comment #3)
> Jan: on a side-note, it seems like Firebug also has a bug here, presumably
> an infinite recursion caused by the cyclic array being passed to
> console.log.  Of course the crash should be fixed, but, even after that, FB
> should be fixed to handle cyclic graphs correctly (by keeping a hash table
> of visited objects, etc); as is, FB is hanging the browser.  Also: it seems
> that FB is repeatedly hitting the recursion limit and then catching and
> ignoring the exception.
Yep, this is reported here:
http://code.google.com/p/fbug/issues/detail?id=3663

We marked it as Firebug 1.10 blocker so, it should be fixed in the final release.
Honza
Comment 5 Luke Wagner [:luke] 2012-06-28 22:29:26 PDT
Created attachment 637785 [details] [diff] [review]
rm StackIter stack sniffing

I found the underlying source of the crash: UncachedInlineCall does not increment regs.pc after it calls popInlineFrame hence *regs.pc stays at JSOP_CALL, even though the args have been popped.  Fixing this actually breaks the rejoin logic in js_InternalInterpret which specifically assumes pc has NOT been incremented, so there is no good fix here.

This whole stack-sniffing thing is to recover inline calls to natives.  This was implemented b/c a year ago I was told by jsdbg2 people that it was needed immediately.  Today, this feature is still unused, thus I'm deciding to remove it.  If jsdbg2 every decides that it needs the feature, we can add it again without using stack sniffing.
Comment 6 Luke Wagner [:luke] 2012-06-28 22:30:46 PDT
Created attachment 637786 [details] [diff] [review]
rm StackIter::sp_

... and with the above patch, there is no longer any good use of sp other than ReportIsNotFunction.  This patch removes a bunch of code and solves the ReportIsNotFunction problem more directly.
Comment 7 Luke Wagner [:luke] 2012-06-28 22:35:07 PDT
Created attachment 637787 [details] [diff] [review]
rm StackIter::sp_

Remove dangling TODOs.
Comment 8 Luke Wagner [:luke] 2012-06-29 09:45:19 PDT
Green on try.
Comment 9 Luke Wagner [:luke] 2012-06-29 14:31:57 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/b323d6090b21
https://hg.mozilla.org/integration/mozilla-inbound/rev/9933d50de880

(This fixes the issues I was seeing; the expression now terminates in an error or a bunch of nested braces after a few seconds.  Jan, can you confirm?)
Comment 11 Simon Lindholm 2012-07-01 15:22:37 PDT
*** Bug 768726 has been marked as a duplicate of this bug. ***
Comment 12 Christian Holler (:decoder) 2012-08-21 06:19:48 PDT
*** Bug 766065 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.