926847 - Assertion failure: hasSlot() && !hasMissingSlot(), at ../vm/Shape.h:1161 or Crash [@ PropertyReadNeedsTypeBarrier] (jit)

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 23bd0deec359 (run with --fuzzing-safe --ion-eager):


a = "".__proto__;
b = unescape().__proto__;
for (var i = 0; i < 1000 ; i++) {
    a.__defineSetter__("valueOf", function() {});
    - b.valueOf;
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Crash trace from opt-build:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000768b8b in PropertyReadNeedsTypeBarrier (cx=0x1423620, constraints=0x143d738, object=0x7ffff6943161, name=<optimized out>, observed=0x14222e0) at js/src/jit/MIR.cpp:2797
2797            if (shape &&
#0  0x0000000000768b8b in PropertyReadNeedsTypeBarrier (cx=0x1423620, constraints=0x143d738, object=0x7ffff6943161, name=<optimized out>, observed=0x14222e0) at js/src/jit/MIR.cpp:2797
#1  0x0000000000771de7 in js::jit::PropertyReadNeedsTypeBarrier (cx=0x1423620, propertycx=<optimized out>, constraints=0x143d738, object=0x7ffff6943161, name=0x7ffff6a23fe0, observed=0x14222e0, updateObserved=true) at js/src/jit/MIR.cpp:2842
#2  0x0000000000772003 in js::jit::PropertyReadNeedsTypeBarrier (cx=0x1423620, propertycx=0x0, constraints=0x143d738, obj=<optimized out>, name=0x7ffff6a23fe0, observed=0x14222e0) at js/src/jit/MIR.cpp:2862
#3  0x00000000006f7493 in js::jit::IonBuilder::jsop_getprop (this=0x143d760, name=0x7ffff6a23fe0) at js/src/jit/IonBuilder.cpp:8047
#4  0x00000000006f2ac8 in js::jit::IonBuilder::inspectOpcode (this=0x143d760, op=<optimized out>) at js/src/jit/IonBuilder.cpp:1593
#5  0x00000000006f3c44 in js::jit::IonBuilder::traverseBytecode (this=0x143d760) at js/src/jit/IonBuilder.cpp:1172
#6  0x00000000006f47bf in js::jit::IonBuilder::build (this=0x143d760) at js/src/jit/IonBuilder.cpp:612
#7  0x00000000006c64d3 in js::jit::IonCompile (cx=0x1423620, script=<optimized out>, baselineFrame=0x7fffffffd1f8, osrPc=0x14cacd0 "\343\001\232", constructing=<optimized out>, executionMode=js::SequentialExecution) at js/src/jit/Ion.cpp:1612
rax     0x0     -1970324836974592
rcx     0x9422ba8       155331496
=> 0x768b8b <PropertyReadNeedsTypeBarrier(JSContext*, js::types::CompilerConstraintList*, js::types::TypeObjectKey*, js::PropertyName*, js::types::TypeSet*)+283>:      cmp    %rax,(%rcx)


Bad crash with a slot assertion, assuming sec-critical.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Another testcase:

__defineSetter__("eval", function() {});
x = this;
x;
(function() {
    x.eval
})()

asserts js debug shell on m-c changeset 23bd0deec359 with --ion-eager at Assertion failure: hasSlot() && !hasMissingSlot(), at vm/Shape.h

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f613d7363bd2
user:        Brian Hackett
date:        Mon Oct 14 12:13:41 2013 -0600
summary:     Bug 924611 - Don't create lazy type objects and type properties in IonBuilder, r=jandem.

Brian, is bug 924611 a possible regressor?

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f613d7363bd2
user:        Brian Hackett
date:        Mon Oct 14 12:13:41 2013 -0600
summary:     Bug 924611 - Don't create lazy type objects and type properties in IonBuilder, r=jandem.

This iteration took 0.778 seconds to run.

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/aa29389b72f3

Comment 7

[Carsten Book [:Tomcat]]

fixed in mozilla-central -> https://hg.mozilla.org/mozilla-central/rev/aa29389b72f3

Comment 8

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.