931008 - Assertion failure: table, at dist/include/js/HashTable.h:1353 or Crash [@ Range]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 5a9ac6fed6ff (run with --fuzzing-safe):


gczeal(9, 2)
serialize(Boolean, Boolean.prototype.valueOf());

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, failed due to error (try manually).

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/7cc3e16e4af1
user:        Steve Fink
date:        Tue Oct 15 23:47:26 2013 -0700
summary:     Bug 861925 - Add an optional parameter to the shell serialize() function for specifying Transferables, r=jorendorff

Steve, is bug 861925 a likely regressor?

Comment 5

[Steve Fink [:sfink] [:s:]]

(In reply to Gary Kwong [:gkw] [:nth10sd] (yes, still catching up on bugmail) from comment #4)
> Steve, is bug 861925 a likely regressor?

Yes, definitely. Looks like an error handling problem.

Comment 6

[Steve Fink [:sfink] [:s:]]

Attachment: Initialize memory field before using it

The problem is that if the transferable array is an invalid type (not an array), then we report an error. But JSStructuredCloneWriter doesn't initialize an AutoObjectUnsigned32HashMap member early enough, so it dies when it tries to trace it.

Comment 7

[Jason Orendorff [:jorendorff]]

Comment on attachment 831696 [details] [diff] [review]
Initialize memory field before using it

Review of attachment 831696 [details] [diff] [review]:
-----------------------------------------------------------------

Subtle. :-\

Comment 8

[Steve Fink [:sfink] [:s:]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/9e7c32fc496a

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9e7c32fc496a

Comment 11

[Ioana (away)]

Tested this with Firefox JS shells on Ubuntu 12.10 x86_x64:

01/31 nightly - Assertion failure: table, at ../../dist/include/js/HashTable.h:1353
Segmentation fault (core dumped)

02/04 beta and 02/05 nightly - TypeError: invalid transferable array for structured clone. Could this error be hiding a still reproducible assertion failure?

Comment 12

[Steve Fink [:sfink] [:s:]]

(In reply to Ioana Budnar, QA [:ioana] from comment #11)
> Tested this with Firefox JS shells on Ubuntu 12.10 x86_x64:
> 
> 01/31 nightly - Assertion failure: table, at
> ../../dist/include/js/HashTable.h:1353
> Segmentation fault (core dumped)
> 
> 02/04 beta and 02/05 nightly - TypeError: invalid transferable array for
> structured clone. Could this error be hiding a still reproducible assertion
> failure?

No. The error is the correct behavior. The crash resulted from mishandling the error. If the error is making it all the way out to the user now, the problem is fixed.

Thanks for checking!