If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Crash [@ js::ToBooleanSlow]

RESOLVED DUPLICATE of bug 879723

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 879723
4 years ago
a year ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {crash, sec-high, testcase})

Trunk
x86_64
Linux
crash, sec-high, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
The following testcase crashes on mozilla-central revision 26ab72bfa9df (run with --ion-eager):


var p = Proxy.create({
  has : function(id) {}
});
Object.prototype.__proto__ = p;
test();
function test() {
  var start = 0;
  var stop  = 0;
  var resolution = 5;
  while (stop - start == 0) {
    start = Date.now();
    stop = Date.now();
  }
  actual = (stop - start <= resolution);
  actual;
}
test();
actual = '';
test();
for (var i = 0; actual ;-i) {}
(Reporter)

Comment 1

4 years ago
The crash itself looks harmless:


Program received signal SIGSEGV, Segmentation fault.
js::ToBooleanSlow (v=...) at js/src/jsbool.cpp:194
194             return v.toString()->length() != 0;
#0  js::ToBooleanSlow (v=...) at js/src/jsbool.cpp:194
#1  0x0000000000847e60 in ToBoolean (v=...) at ../jsapi.h:1550
#2  js::ion::DoToBoolFallback (cx=0x19487b0, frame=0x7fffffffd408, stub=0x195a0a0, arg=$jsval(<error reading variable: Cannot access memory at address 0x7fff00000001>), ret=...) at js/src/ion/BaselineIC.cpp:2068
#3  0x00007ffff7f994da in ?? ()
[...]
rax     0x1     140733193388033
=> 0x477d05 <js::ToBooleanSlow(JS::Value const&)+213>:  mov    (%rax),%rax
   0x477d08 <js::ToBooleanSlow(JS::Value const&)+216>:  shr    $0x4,%rax



However, before reducing, this test asserted instead with

Assertion failure: (ptrBits & 0x7) == 0, at ./dist/include/js/Value.h:734

and in an opt-build I got this instead:

Assertion failure: [barrier verifier] Unmarked edge: <unknown>, at gc/Verifier.cpp:614


Both seem to indicate a GC problem, so I'm going to assume that this is s-s. Please let me know if the bug reproduced by this test and the assertions are connected. If not, then I will try to produce a second testcase reproducing the ptrBits assertion.
(Reporter)

Comment 2

4 years ago
Created attachment 749883 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 3

4 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   129595:a8d0317c24c1
user:        Brian Hackett
date:        Sun Apr 14 06:40:58 2013 -0600
summary:     Bug 861419 - Consider values in prototype when reading global names during Ion compilation.

This iteration took 11.935 seconds to run.
(Reporter)

Comment 4

4 years ago
Brian, can you take a look based on comment 3? Thanks.
Flags: needinfo?(bhackett1024)
Conservatively marking this high based on the assertion failures from comment 1.
Keywords: sec-high
WFM on tip, can you still reproduce?  The blame is almost certainly wrong, that bug is pretty innocuous.
Flags: needinfo?(bhackett1024)
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,reconfirm]
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,reconfirm] → [jsbugmon:update,reconfirm,ignore]
(Reporter)

Comment 7

4 years ago
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision 8eebe35aae63).

Updated

4 years ago
Whiteboard: [jsbugmon:update,reconfirm,ignore] → [jsbugmon:update,reconfirm]
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,reconfirm] → [jsbugmon:update,reconfirm,ignore]
(Reporter)

Comment 8

4 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 4c4dec8506ab).
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:update,reconfirm,ignore] → [jsbugmon:bisectfix]
(Reporter)

Updated

4 years ago
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
(Reporter)

Comment 9

4 years ago
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/7ecbdd658637
user:        Shu-yu Guo
date:        Mon Jun 10 12:10:13 2013 -0700
summary:     Bug 879723 - Make sure property types reflect inherited types from the prototype when specializing a setgname. (r=bhackett)

This iteration took 10.762 seconds to run.
(Reporter)

Comment 10

4 years ago
Shu, is the bug in comment 9 likely the fix for this bug?
Flags: needinfo?(shu)

Comment 11

4 years ago
(In reply to Christian Holler (:decoder) from comment #10)
> Shu, is the bug in comment 9 likely the fix for this bug?

Can't say for sure, but likely, since the fuzz test case futzes with the proto chain.
Flags: needinfo?(shu)
(Reporter)

Updated

4 years ago
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 879723

Updated

2 years ago
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.