Assertion failure: isObject(), at ../../jsapi.h:474 or Opt Crash [@ js_IteratorMore]

RESOLVED FIXED in mozilla17

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: decoder, Assigned: jorendorff)

Tracking

(Blocks: 2 bugs, 4 keywords)

Trunk
mozilla17
x86
Linux
assertion, crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [js:p2][jsbugmon:update], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following test asserts/crashes on mozilla-central revision b6aa44d8f11f (options -m -n -a):


Array.prototype.iterator = (function() { { while(0) function Uint8ClampedArray() {  } } });
assertEq(Set(["testing", "testing", 123]).size(), 2);


Opt-crash trace:

==35441== Invalid read of size 4
==35441==    at 0x80CE74F: js_IteratorMore(JSContext*, JS::Handle<JSObject*>, JS::Value*) (jsiter.cpp:1762)
==35441==    by 0xFFFFFF81: ???
==35441==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
Blocks: 349611

Comment 1

5 years ago
The first bad revision is:
changeset:   cb49c3730a97
user:        Jason Orendorff
date:        Tue Jul 03 16:34:56 2012 -0500
summary:     Bug 725907 - for-of improvements, part 2: Make for-of loops just call .iterator() instead of using the magic iteratorObject hook with an extra flag. r=bhackett.

The first good revision is:
changeset:   aadf6091245b
user:        Ehsan Akhgari
date:        Wed Jul 04 19:26:20 2012 -0400
summary:     Backout changeset cb49c3730a97 (bug 725907 part 2) under the suspicion of breaking Linux32 mochitest-chrome without framepointers
Blocks: 725907
Keywords: regression
(Assignee)

Comment 2

5 years ago
Reproduced. Even without -m -n -a. Taking.
Assignee: general → jorendorff
(Assignee)

Comment 3

5 years ago
Created attachment 639693 [details] [diff] [review]
v1

Yup. Easy fix. Right on, fuzzers.
Attachment #639693 - Flags: review?(bhackett1024)
Attachment #639693 - Flags: review?(bhackett1024) → review+
(In reply to Jason Orendorff [:jorendorff] from comment #3)
> Created attachment 639693 [details] [diff] [review]
> v1
> 
> Yup. Easy fix. Right on, fuzzers.

Unfortunately, I think the patch now has a little bit of bitrot to land on mozilla-inbound.
(Assignee)

Comment 5

5 years ago
No worries. The Map/Set iterators were backed out due to unrelated brain damage, but when I reland them, I'll land this fix along with them.
Whiteboard: js-triage-needed [jsbugmon:update] → [js:p2][jsbugmon:update]
https://hg.mozilla.org/mozilla-central/rev/a04de3c84630
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
(Reporter)

Comment 7

4 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.