Last Comment Bug 788364 - Invalid write of size 8 [@ js::SetIteratorObject::finalize]
: Invalid write of size 8 [@ js::SetIteratorObject::finalize]
Status: VERIFIED DUPLICATE of bug 779025
[sg:dupe 779025]
: regression, sec-critical, testcase, valgrind
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 All
: -- critical (vote)
: ---
Assigned To: Jason Orendorff [:jorendorff]
: general
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz 725909
  Show dependency treegraph
 
Reported: 2012-09-04 17:40 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-03-11 06:05 PDT (History)
5 users (show)
choller: in‑testsuite-
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected
unaffected
fixed
fixed
unaffected


Attachments
Valgrind stack (2.86 KB, text/plain)
2012-09-04 17:40 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description Gary Kwong [:gkw] [:nth10sd] 2012-09-04 17:40:30 PDT
Created attachment 658316 [details]
Valgrind stack

x = new Set
x.add()
for (v of x) {
  y
}

shows the following error on 64-bit js opt shell on m-c changeset 7c75cd38626a :

==15342== Invalid write of size 8
==15342==    at 0x60C8FB: js::SetIteratorObject::finalize(js::FreeOp*, JSObject*) (MapObject.cpp:295)
==15342==    by 0x47C5B9: bool js::gc::Arena::finalize<JSObject>(js::FreeOp*, js::gc::AllocKind, unsigned long) (jsobjinlines.h:235)
==15342==    by 0x4803E5: js::gc::FinalizeArenas(js::FreeOp*, js::gc::ArenaHeader**, js::gc::ArenaList&, js::gc::AllocKind, js::SliceBudget&) [clone .constprop.342] (jsgc.cpp:412)
==15342==    by 0x482E16: IncrementalCollectSlice(JSRuntime*, long, js::gcreason::Reason, js::JSGCInvocationKind) (jsgc.cpp:1626)
==15342==    by 0x483BCC: GCCycle(JSRuntime*, bool, long, js::JSGCInvocationKind, js::gcreason::Reason) (jsgc.cpp:4392)
==15342==    by 0x484007: Collect(JSRuntime*, bool, long, js::JSGCInvocationKind, js::gcreason::Reason) [clone .part.316] (jsgc.cpp:4500)
==15342==    by 0x4449C3: js::DestroyContext(JSContext*, js::DestroyContextMode) (jscntxt.cpp:436)
==15342==    by 0x4097E4: DestroyContext(JSContext*, bool) (js.cpp:4594)
==15342==    by 0x4042BD: main (js.cpp:4957)

using the following command on Ubuntu Linux 12.04 with Valgrind SVN build r12957:

valgrind ./js testcase.js

s-s because this is an invalid write.
Comment 1 Christian Holler (:decoder) 2012-09-05 03:56:52 PDT
Could be related to bug 779025 but I guess jorendorff is the best person to ask here :)
Comment 2 Andrew McCreight [:mccr8] 2012-09-05 10:23:39 PDT
Iterable sets initially landed in bug 725909. I'm just going to mark this sg-crit, as it seems sketchy.  Feel free to downgrade as appropriate.
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2012-09-06 14:24:32 PDT
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   100489:76fba3ad58dd
user:        Jason Orendorff
date:        Wed Jul 04 10:24:25 2012 -0500
summary:     Bug 725909 - Make Maps and Sets iterable. r=luke.
Comment 4 Jason Orendorff [:jorendorff] 2012-09-20 13:37:12 PDT
Gary, can you confirm that rev 278080ef7545 fixed this?

*** This bug has been marked as a duplicate of bug 779025 ***
Comment 5 Gary Kwong [:gkw] [:nth10sd] 2012-09-20 14:00:01 PDT
I verify that the error shows up in the parent of rev 278080ef7545 , which is 3091da11f7ab, but not in 278080ef7545 itself.

-> VERIFIED
Comment 6 Christian Holler (:decoder) 2013-03-11 06:05:59 PDT
This is already covered by a jit-test, in-testsuite-.

Note You need to log in before you can comment on or make changes to this bug.