936403 - Crash [@ operator] or [@ JSObject::nativeSetSlotWithType] or Assertion failure: obj, at dist/include/js/Value.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

s = newGlobal()
function f(code) {
    evalcx(code, s)
}
f("\
    c = [];\
    var x;\
    for each(z in[\
        x,,[],,new Number,,,,new Number,,,,new Number,new Number,[],\
        ,,,[],,new Number,,new Number,,[],new Number,[],,,,,,[],\
        new Number,,new Number,[],,[],,,,[],,[],,,,,,,,,[],[],,[],\
        [],[],,new Number,[],[],,[],,new Number,new Number,new Number,\
        new Number,new Number,,,new Number,new Number,,[],[],[],,,[],\
        [],[],new Number,,new Number,,,,,[],new Number,new Number,[],\
        [],[],[],,x,[]]\
    ) {\
        c = z\
    };\
");
f("c");

asserts js debug shell on m-c changeset c44f12776a87 with --ion-eager at Assertion failure: obj, at dist/include/js/Value.h and unreduced variants of this used to crash at operator with JSObject::nativeSetSlotWithType on the stack.

My configure flags are:

sh ./configure --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --disable-threadsafe

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Tested on 64-bit debug shell on Ubuntu Linux 13.04.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Turning s-s to be safe, there's a gc line on the crash stack and there are a few memory addresses at the bottom of the assertion stack too.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/636620b3af0a
user:        Brian Hackett
date:        Tue Oct 29 16:10:59 2013 -0600
summary:     Bug 930048 - Remove need to read objects directly when optimizing singleton accesses, r=jandem.

Brian, is bug 930048 a likely regressor?

Comment 5

[Daniel Veditz [:dveditz]]

Is this just a null pointer deref or am I misreading the stacks?

Comment 6

[Brian Hackett [Laid off!]]

Attachment: patch

Baseline update ICs could write undefined values to global slots without the undefined value being reflected in the global's type information.

Comment 7

[Brian Hackett [Laid off!]]

Yeah, this is a null pointer deref.

https://hg.mozilla.org/integration/mozilla-inbound/rev/4f05b7cf7d11

Comment 8

[Brian Hackett [Laid off!]]

No clue why that unset s-s.

Comment 9

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/4f05b7cf7d11

Comment 10

[David Chan [:dchan]]

Per comment 4 b2g18 and b2g1.1 are unaffected. The changeset landed after the Fx26 branch so b2g1.2 /should/ be okay