881470 - Crash [@ JSRuntime::needsBarrier] or [@ js::EncapsulatedValue::runtime]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

s = newGlobal()
try {
    evalcx("\
        Object.defineProperty(this,\"x\",{ \
            get: function() {\
                y[15] = y;\
                x \
            }\
        });\
        y = [];\
        Array(x);\
    ", s)
} catch (e) {}
try {
    evalcx("\
        y = [];\
        x, {};\
    ", s)
} catch (e) {}
evalcx("\
    Array.prototype.shift.call(y); \
", s)

crashes js debug shell on m-c changeset 9115d8b717e1 without any CLI arguments at JSRuntime::needsBarrier

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/3835cbed5915
user:        Nicolas B. Pierron
date:        Fri May 24 14:58:08 2013 -0700
summary:     Bug 774006 - IonMonkey: Implement SetElementIC for integer indexes. r=h4writer


Setting needinfo from Hannes since Nicolas is away on PTO, but feel free to forward this on.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Opt shell crash stack

try {
    Object.defineProperty(this, "y", {
        get: function() {
            x[7] = x;
            y
        }
    });
    x = RegExp().exec();
    y;
} catch (e) {}
try {
    y
} catch (e) {};
try {
    y
} catch (e) {};
x.t = 2;
y;

crashes js opt shell (no need for threadsafe nor --enable-more-deterministic) on m-c rev 291207393608 at js::EncapsulatedValue::runtime, turning s-s just in case.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The testcase in comment 3 also points to bug 774006.

Comment 5

[Hannes Verschore [:h4writer]]

Attachment: Possible patch?

I cannot reproduce this bug locally. Either testcases on the tested revision 64bit/32bit/safebuild/enable-deterministic w/wo ion-eager.

So this is actually just a guess. Could you test if this solves the problem?

Comment 6

[Andrew McCreight [:mccr8]]

sounds kind of bad...

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 761382 [details] [diff] [review]
Possible patch?

(In reply to Hannes Verschore [:h4writer] from comment #5)
> Created attachment 761382 [details] [diff] [review]
> Possible patch?
> 
> I cannot reproduce this bug locally. Either testcases on the tested revision
> 64bit/32bit/safebuild/enable-deterministic w/wo ion-eager.
> 
> So this is actually just a guess. Could you test if this solves the problem?

I tested this on Mac 10.8.4, and yes, this patch does fix the issue on rev b51316b2af6c.

Comment 8

[Jan de Mooij [:jandem]]

Comment on attachment 761382 [details] [diff] [review]
Possible patch?

Review of attachment 761382 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I'm restarting a round of fuzzing after whole-day breakage, so I've landed this too (since this fixes bug 879096 as well):

https://hg.mozilla.org/integration/mozilla-inbound/rev/5efe6470e752

I'll drop a note to Hannes.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5efe6470e752

Comment 11

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.