926841 - Crash [@ js::EncapsulatedPtr] or Opt-Crash [@ js::jit::Compile] with setObjectMetadataCallback

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 23bd0deec359 (threadsafe build, run with --fuzzing-safe --thread-count=2 --ion-parallel-compile=on --ion-eager):


function callback(obj) {}
setObjectMetadataCallback(callback);
w = new callback();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Jan de Mooij [:jandem]]

Brian, this is a setObjectMetadataCallback issue I think.

We trigger an off-thread compilation here jit::CanEnter -> CreateThisForFunction -> fun_resolve -> ShellObjectMetadataCallback -> jit::Compile.

Then we return to jit::CanEnter and crash in Compile because script->ion == ION_COMPILING_SCRIPT...

Comment 3

[Brian Hackett [Laid off!]]

This should be fixed by bug 950118.

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to Brian Hackett (:bhackett) from comment #3)
> This should be fixed by bug 950118.

true?

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 6

[Christian Holler (:decoder)]

Haven't seen this in a while and it should be fixed according to comment 3, marking WFM.

Comment 7

[alex_mayorga]

¡Hola Christian!

Got this one in Nightly

Report ID 	Date Submitted
bp-a90fb719-30f9-43d2-bcad-616422151030
	10/30/2015	12:42 PM


Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	js::jit::Compile 	js/src/jit/Ion.cpp
1 	xul.dll 	js::jit::CanEnter(JSContext*, js::RunState&) 	js/src/jit/Ion.cpp
2 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
3 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
4 	xul.dll 	js::fun_apply(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp
5 		@0x18d54e42 	

Shall I reopen this bug, file a new one or just ignore the crash until I have reproducible steps?

¡Gracias!
Alex

Comment 8

[Christian Holler (:decoder)]

Your bug is probably different to this one, the crash signature you are seeing is very generic. If you manage to find a testcase/steps to reproduce, please file a new bug. 

¡Thanks!