833076 - IonMonkey: Assertion failure: script->types, at ../jsinferinlines.h:992 or Crash [@ js_CreateThisForFunctionWithProto]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 4919e8091542 (run with --ion-eager):


eval("(function() { " + "\
var Constr = function( ... property)  {};\
Constr.prototype = 0.0;\
var c = new Constr(  ) ;\
" + " })();");

Comment 1

[Christian Holler (:decoder)]

Crash looks harmless:

==4558== Invalid read of size 4
==4558==    at 0x4D8691: js_CreateThisForFunctionWithProto(JSContext*, JS::Handle<JSObject*>, JSObject*) (jsobj.cpp:4840)
==4558==    by 0x4D8B8E: js_CreateThisForFunction(JSContext*, JS::Handle<JSObject*>, bool) (jsobj.cpp:1452)
==4558==    by 0x788DB1: js::ion::CreateThis(JSContext*, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) (VMFunctions.cpp:503)
==4558==    by 0x4029765: ???
==4558==    by 0x6EC7A1: EnterIon(JSContext*, js::StackFrame*, void*) (Ion.cpp:1578)
==4558==    by 0x4B162D: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2415)
==4558==    by 0x4B3AAA: js::RunScript(JSContext*, JS::Handle<JSScript*>, js::StackFrame*) (jsinterp.cpp:348)
==4558==    by 0x4B3D04: js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::ExecuteType, js::StackFrame*, JS::Value*) (jsinterp.cpp:537)
==4558==    by 0x616D3A: EvalKernel(JSContext*, JS::CallArgs const&, EvalType, js::StackFrame*, JS::Handle<JSObject*>) (Eval.cpp:286)
==4558==    by 0x618148: js::DirectEval(JSContext*, JS::CallArgs const&) (Eval.cpp:337)
==4558==    by 0x4AE3A5: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2334)
==4558==    by 0x4B3AAA: js::RunScript(JSContext*, JS::Handle<JSScript*>, js::StackFrame*) (jsinterp.cpp:348)
==4558==  Address 0x48 is not stack'd, malloc'd or (recently) free'd

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, failed due to error (try manually).

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, failed due to error (try manually).

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unknown exception (check manually)

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   119380:88daef90f2ab
user:        Brian Hackett
date:        Sun Jan 20 02:49:21 2013 -0700
summary:     Bug 821361 - Optimize type information in closures that only run once, r=luke.

This iteration took 111.004 seconds to run.

Comment 6

[Christian Holler (:decoder)]

Brian or Luke, can you take a look?

Comment 7

[Brian Hackett [Laid off!]]

Attachment: patch

Preexisting issue, though I don't think it was possible to hit before bug 821361.

Comment 8

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/839b5dce269c

Comment 9

[Brian Hackett [Laid off!]]

Comment on attachment 725767 [details] [diff] [review]
patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): old, recently exposed
User impact if declined: potential null crash
Risk to taking this patch (and alternatives if risky): none

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/839b5dce269c

Comment 11

[bhavana bajaj [:bajaj]]

Comment on attachment 725767 [details] [diff] [review]
patch

low risk patch, avoids null crash.Approving for uplift

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/ee434bd8a03b

Comment 13

[Biraj Karmakar [:biraj]]

is there any manual verification needed, considering the automated test that is available?

Comment 14

[Christian Holler (:decoder)]

No verification needed as the test has been landed (and also uplifted).

Comment 15

[u279076]

Marking [qa-] as per comment 14. Please remove this whiteboard tag and add the qawanted keyword if some testing is needed.