930543 - Assertion failure: JSVAL_IS_DOUBLE_IMPL(l), at dist/include/js/Value.h:406 or Crash [@ js::LoadScalarfloat::Func] or Crash [@ js::jit::BaselineScript::nativeCodeForPC]

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 19fd3388c372 (run with --fuzzing-safe):


var T = TypedObject;
var Point = new T.ArrayType(T.float32, 3);
var Line = new T.StructType({from: Point, to: Point});
var Lines = new T.ArrayType(Line, 3);
var lines = new Lines([
  {from: [1, 2, 3], to: [4, 5, 6]},
  {from: [7, 8, 9], to: [10, 11, 12]},
  {from: [13, 14, 15], to: [16, 17, 18]}
]);
function allPoints(lines, func) {
  var handle = Point.handle();
  for (var i = 0; i < lines.length; i-- ) {
    T.Handle.move(handle, lines, i, "from");
    func(handle);
  }
}
allPoints(lines, function(p) {
  p[0] += 100;
});

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Optimized trace:


Program received signal SIGSEGV, Segmentation fault.
0x0000000000a0be25 in js::LoadScalarfloat::Func (argc=<optimized out>, vp=0x7fffffffa1b8) at js/src/builtin/TypedObject.cpp:2528
2528    JS_FOR_EACH_UNIQUE_SCALAR_TYPE_REPR_CTYPE(JS_LOAD_SCALAR_CLASS_IMPL)
#0  0x0000000000a0be25 in js::LoadScalarfloat::Func (argc=<optimized out>, vp=0x7fffffffa1b8) at js/src/builtin/TypedObject.cpp:2528
#1  0x00007ffff7f30f1b in ?? ()
#2  0xfffbfffff6246370 in ?? ()
#3  0x00007fffffffa190 in ?? ()
#4  0x0000000000000000 in ?? ()
rax     0x1808298       4320166552
r12     0x0     0
=> 0xa0be25 <js::LoadScalarfloat::Func(js::ThreadSafeContext*, unsigned int, JS::Value*)+277>:  movss  (%rax,%r12,1),%xmm0


S-s and sec-critical due to dangerous crash.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/35a83682c173
user:        Nicholas D. Matsakis
date:        Wed Sep 11 16:24:23 2013 -0400
summary:     Bug 898342 - Implement movable handles for Typed Objects r=till

This iteration took 425.481 seconds to run.

Comment 4

[Niko Matsakis [:nmatsakis]]

I'll take a look.

Comment 5

[Niko Matsakis [:nmatsakis]]

Forgot to check for negative indices (sigh).

Comment 6

[Niko Matsakis [:nmatsakis]]

Attachment: Bug930543.diff

Comment 7

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 8

[Niko Matsakis [:nmatsakis]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/54c65daa9bed

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/54c65daa9bed

Comment 10

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.