Assertion failure: isObject(), at js/Value.h:1068 or Crash [@ TraceArrayBufferView]

VERIFIED FIXED

Status

()

--
critical
VERIFIED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, 5 keywords)

Trunk
x86_64
Linux
assertion, crash, regression, sec-high, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox22 unaffected, firefox23 unaffected, firefox24 unaffected, firefox25 fixed, firefox-esr17 unaffected, b2g18 unaffected, b2g18-v1.0.0 unaffected, b2g18-v1.0.1 unaffected, b2g-v1.1hd unaffected)

Details

(Whiteboard: [jsbugmon:update], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following testcase asserts on mozilla-central revision 4ffb23062b3b (run with --fuzzing-safe --ion-eager):


gczeal(2,4);
function asmModule(heap) {
    var g = newGlobal('new-compartment');
    new g.Int8Array(heap);
}
asmModule(new ArrayBuffer(2048));
(Reporter)

Comment 1

6 years ago
Created attachment 770110 [details]
[crash-signature] Machine-readable crash signature
(Reporter)

Comment 2

6 years ago
Not sure if this is actually s-s. Is it possible to get an Int8Array constructor from a different global without the newGlobal function?
Crash Signature: [@ TraceArrayBufferView]
Keywords: crash
Whiteboard: [jsbugmon:update,bisect]
The assert reproduces with --no-ion --no-baseline --no-asmjs.  I'd expect that this is a typed array GC bug.
Summary: OdinMonkey: Assertion failure: isObject(), at js/Value.h:1068 or Crash [@ TraceArrayBufferView] → Assertion failure: isObject(), at js/Value.h:1068 or Crash [@ TraceArrayBufferView]
Random note decoder/gary: it might be useful to have a gczeal() mode that triggers all the time, but only after the self-hosted code has finished loading; I think that is what makes this testcase take so long.
Marking high because it sounds like a GC bug.  Adjust the rating as needed.
Keywords: sec-high
(Reporter)

Updated

6 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 6

6 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/866dbb8830d1
user:        Terrence Cole
date:        Mon Jun 24 17:33:27 2013 -0700
summary:     Bug 886575 - Update TypedArray's data slot when doing fallback marking for minor GC; r=sfink

This iteration took 325.986 seconds to run.
(Reporter)

Updated

6 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
(Reporter)

Comment 7

6 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision f2d3b5149d3a).
I suspect this was fixed by bug 891773, but let's recheck.
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update,bisectfix]
(Reporter)

Updated

6 years ago
Whiteboard: [jsbugmon:update,bisectfix] → [jsbugmon:update,bisectfix,ignore]
(Reporter)

Comment 9

6 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 3433a021847b).
Whiteboard: [jsbugmon:update,bisectfix,ignore] → [jsbugmon:bisectfix]
(Reporter)

Updated

6 years ago
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
(Reporter)

Comment 10

6 years ago
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/9a908856c46c
user:        Terrence Cole
date:        Thu Jul 11 14:34:54 2013 -0700
summary:     Bug 891773 - Check ArrayBufferView's back reference before marking; r=sfink

This iteration took 345.087 seconds to run.
Yup, fixed by bug 891773.
Blocks: 886575
Status: NEW → RESOLVED
Last Resolved: 6 years ago
status-b2g18: --- → unaffected
status-b2g18-v1.0.0: --- → unaffected
status-b2g18-v1.0.1: --- → unaffected
status-b2g-v1.1hd: --- → unaffected
status-firefox22: --- → unaffected
status-firefox23: --- → unaffected
status-firefox24: --- → unaffected
status-firefox25: --- → fixed
status-firefox-esr17: --- → unaffected
Keywords: regression
Resolution: --- → FIXED
Whiteboard: [jsbugmon:] → [jsbugmon:update]
(Reporter)

Updated

6 years ago
Status: RESOLVED → VERIFIED
(Reporter)

Comment 12

6 years ago
JSBugMon: This bug has been automatically verified fixed.
Group: core-security
You need to log in before you can comment on or make changes to this bug.