769433 - Assertion failure: objArrayType >= 0 && objArrayType < TypedArray::TYPE_MAX, at jsinfer.cpp:1756 or Opt-Crash [@ js::mjit::Assembler::storeToTypedArray]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts/crashes on mozilla-central revision 9bf5e71c5746 (options -m -n -a):


function stringConvert() {
  var a = Uint32Array.prototype;
  for (var i = 0; i < 10; i++) {
    a[0] = 1 >> s1;
  }
}
stringConvert();


Valgrind trace from opt-build:

==47271== Invalid read of size 4
==47271==    at 0x5E2A59: js::mjit::Assembler::storeToTypedArray(int, JSC::X86Registers::RegisterID, js::mjit::Int32Key, js::mjit::ValueRemat) (jstypedarrayinlines.h:119)
==47271==    by 0x5E71BB: js::mjit::Compiler::jsop_setelem_typed(int) (FastOps.cpp:1474)
==47271==    by 0x5E9EDF: js::mjit::Compiler::jsop_setelem(bool) (FastOps.cpp:1556)
==47271==    by 0x5B8E04: js::mjit::Compiler::generateMethod() (Compiler.cpp:2607)
==47271==    by 0x5BF130: js::mjit::Compiler::performCompilation() (Compiler.cpp:517)
==47271==    by 0x5BF1EA: js::mjit::Compiler::compile() (Compiler.cpp:112)
==47271==    by 0x5C0B34: js::mjit::CanMethodJIT(JSContext*, JSScript*, unsigned char*, bool, js::mjit::CompileRequest) (Compiler.cpp:978)
==47271==    by 0x47DC35: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:1489)
==47271==    by 0x58FF93: js::mjit::EnterMethodJIT(JSContext*, js::StackFrame*, void*, JS::Value*, bool) (MethodJIT.cpp:1043)
==47271==    by 0x5900E2: js::mjit::JaegerShot(JSContext*, bool) (MethodJIT.cpp:1074)
==47271==    by 0x47F5E9: js::RunScript(JSContext*, JSScript*, js::StackFrame*) (jsinterp.cpp:264)
==47271==    by 0x4801E1: js::Execute(JSContext*, JSScript*, JSObject&, JS::Value*) (jsinterp.cpp:455)
==47271==  Address 0x37e112078 is not stack'd, malloc'd or (recently) free'd


Looks like a critical corruption, s-s.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = new Uint8ClampedArray;
y = x.__proto__;
(function() {
  for (var z = 0; z < 9; ++z) {
    y[0];
  }
})()

is another testcase that has a similar assertion on m-c changeset rev 081d8578beb1.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   97780:195ffaea56ea
user:        Brian Hackett
date:        Wed Jun 27 07:10:50 2012 -0700
summary:     Specialize big typed arrays with singleton types, bug 762561. r=dvander

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

JSObject::makeLazyType needs to look for typed array prototypes, which have a typed array proto key but are regular native objects.

Comment 4

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b1f1aeec7132

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/mozilla-central/rev/b1f1aeec7132

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug769433.js.