883626 - Crash [@ js::ion::GetPcScript]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

x = (function() {
    yield
})()
Array.prototype.unshift.call(x, x);
Array.prototype.unshift.call(x, /x/)
Array.prototype.sort.call(x, (function(t, foreign) {
    "use asm";
    var ff = foreign.ff
    function f() {
        return +ff()
    }
    return f
})(this, {
    ff: SyntaxError
}))


crashes js debug and opt shell on m-c changeset 36da3cb92193 without any CLI arguments at js::ion::GetPcScript (opt shell crashes at a near NULL deref).

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/05bf9122d234
user:        Benjamin Bouvier
date:        Thu Jun 13 11:47:09 2013 -0700
summary:     Bug 882514: Don't try to enable Ion on functions with no script; r=h4writer

Comment 1

[Jesse Ruderman]

The asm function doesn't have to be called through sort.  This also crashes:

(function(t, foreign) {
    "use asm";
    var ff = foreign.ff
    function f() {
        return +ff()
    }
    return f
})(this, {
    ff: SyntaxError
})()

Comment 2

[Alice0775 White]

I can reproduce the crash
bp-af183c46-a39c-474c-9bb9-6365f2130616

Steps to reproduce:
1. Install https://addons.mozilla.org/en-US/firefox/addon/execute-js/?src=search and restart
2. Alt > Tools > Open Execute JS
3. Paste JS code of comment #0 to upper-left pane
4. Click Execute button

Actual Results:
Crash

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/6f52e55ac5be
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130612 Firefox/24.0 ID:20130612124657
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/2810e80e1393
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130612 Firefox/24.0 ID:20130612130058
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=6f52e55ac5be&tochange=2810e80e1393

Triggered by:
2810e80e1393	Hannes Verschore — Bug 860838: OdinMonkey: Optimize FFI calls to ionmonkey, r=luke


And following builds also craches, So, it is different regression range in comment #0.
http://hg.mozilla.org/integration/mozilla-inbound/rev/03e03ea1a842
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130613 Firefox/24.0 ID:20130613104608
http://hg.mozilla.org/integration/mozilla-inbound/rev/05bf9122d234
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130613 Firefox/24.0 ID:20130613114805

Comment 3

[Hannes Verschore [:h4writer]]

I'll take this bug. I have an idea where the fault located is. It is not a fall-out from bug 860838, but from the original bug 860838.

Comment 4

[Hannes Verschore [:h4writer]]

*not a fall-out from bug 882514

Comment 5

[Hannes Verschore [:h4writer]]

Attachment: Patch

This fixes the problem here. Gonna quickly check if there are more places where we hit this.

Comment 6

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e4dd6f0845c5

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e4dd6f0845c5