783543 - Crash [@ js::gc::Cell::compartment]

Status: RESOLVED DUPLICATE of bug 783315

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test crashes on mozilla-central revision 1ecca798b1fb (options -m -n -a):


try { 
  evaluate("  (function(c) { const x = 1; for (x in null); })();"); 
  var expect = "Passed";
} catch ( e ) {
  result = expect;
}
schedulegc(10);
eval("var o = new MyObject(); var result = 0; for (var o in foo) { result += this[o]; } ") 
function MyObject() {}


Crash trace:

==3301== Invalid read of size 4
==3301==    at 0x804D3A3: js::gc::Cell::compartment() const (Heap.h:1010)
==3301==    by 0x83A9E65: void js::gc::CheckMarkedThing<js::PropertyName>(JSTracer*, js::PropertyName*) (Marking.cpp:86)
==3301==    by 0x83A6457: void js::gc::MarkInternal<js::PropertyName>(JSTracer*, js::PropertyName**) (Marking.cpp:108)
==3301==    by 0x83A3FDE: void js::gc::MarkUnbarriered<js::PropertyName>(JSTracer*, js::PropertyName**, char const*) (Marking.cpp:137)
==3301==    by 0x839CF3C: js::gc::MarkStringUnbarriered(JSTracer*, js::PropertyName**, char const*) (Marking.cpp:246)
==3301==    by 0x82295F0: js::Bindings::trace(JSTracer*) (jsscript.cpp:232)
==3301==    by 0x822EBDB: JSScript::markChildren(JSTracer*) (jsscript.cpp:2425)
==3301==    by 0x839F022: js::gc::MarkChildren(JSTracer*, JSScript*) (Marking.cpp:773)
==3301==    by 0x839E439: js::gc::PushMarkStack(js::GCMarker*, JSScript*) (Marking.cpp:583)
==3301==    by 0x83A4C20: void js::gc::MarkInternal<JSScript>(JSTracer*, JSScript**) (Marking.cpp:116)
==3301==    by 0x83A29E3: void js::gc::MarkRoot<JSScript>(JSTracer*, JSScript**, char const*) (Marking.cpp:154)
==3301==    by 0x839C9D5: js::gc::MarkScriptRoot(JSTracer*, JSScript**, char const*) (Marking.cpp:240)
==3301==  Address 0xcdcdc000 is not stack'd, malloc'd or (recently) free'd



Might be a duplicate of one of the previous bugs that Gary and I reported, but it looks particular dangerous so I would like to make sure it's not missed.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision f5f29adc6d30).

Comment 2

[Luke Wagner [:luke]]

I'll add the test-case though, nice find!

Comment 3

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7e0c5cdfc648

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7e0c5cdfc648

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug783543.js.