871857 - Assertion failure: idx < arrobj->getDenseInitializedLength(), at vm/SelfHosting.cpp:365 or Assertion failure: args[arri].isObject(), at vm/SelfHosting.cpp:356 or Crash [@ js::intrinsic_UnsafeSetElement]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 7130e5134a6e (run with --ion-eager):


function addTestCase( d, t ) {}
var UnsafeSetElement = getSelfHostedValue("UnsafeSetElement");
UnsafeSetElement(addTestCase, 1, 0)

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

I didn't mark this s-s because I assume the bug cannot be triggered without the "getSelfHostedValue" function which seems to be shell-only. It would still be nice if calling our shell functions would not lead to crashes :)

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   121211:80a21124ddbd
user:        Nicholas D. Matsakis
date:        Thu Feb 07 11:34:43 2013 -0800
summary:     Bug 807853 - Add (but do not yet use) parallel compilation mode to ion r=dvander,terrence

This iteration took 103.156 seconds to run.

Comment 4

[Jeff Walden [:Waldo]]

getSelfHostedValue exposes super-internal methods with very particular internal requirements.  It is absurdly trivial to call many to most to all of those methods and hit asserts or crash.  Blacklist the results of getSelfHostedValue so they're never called, please.

Comment 5

[Christian Holler (:decoder)]

There's no way to blacklist the result of anything in LangFuzz (and it cannot be done). I can delete the function from global but you can still get it back by creating a new global/compartment and I've seen this happening with "trap" for example. It's a bad idea to put such functions into the shell without a way to disable them somehow, imo :)

Comment 6

[Till Schneidereit [:till]]

Waldo and I talked about this and decided to only expose the function if MOZ_SELFHOSTEDJS is set. That instructs SpiderMonkey to load an external JS file as the self-hosting code instead of using the embedded code. Since the main usecase for getSelfHostedValue is to enable experimentation with self-hosted code without having to recompile, this should work nicely.

Comment 7

[Till Schneidereit [:till]]

Attachment: Only expose the Shell function getSelfHostedValue if MOZ_SELFHOSTEDJS is set.

After IRC discussions with nmatsakis, I just removed the only jit-test relying on getSelfHostedValue.

Comment 8

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 9

[Till Schneidereit [:till]]

Thanks!

https://hg.mozilla.org/integration/mozilla-inbound/rev/5c4392f60d58

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5c4392f60d58