942379 - Crash [@ js::BarrieredPtr] with resolver

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

resolver([], undefined)

crashes js debug shell on m-c changeset f7ad046f783f with --fuzzing-safe at js::BarrieredPtr

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

Jason, this is probably an older bug, do you think you might be able to take a look and see what's wrong?

Comment 1

[Jason Orendorff [:jorendorff]]

Yup. I'll get to it tomorrow.

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: v1

As a matter of personal reflection: it seems I'd rather write CallArgs boilerplate than go look up the JS_ConvertArguments mini-language.

Comment 3

[Jeff Walden [:Waldo]]

Comment on attachment 8338674 [details] [diff] [review]
v1

Review of attachment 8338674 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/shell/js.cpp
@@ +2712,5 @@
>  
>  static bool
>  Resolver(JSContext *cx, unsigned argc, jsval *vp)
>  {
> +    CallArgs args = CallArgsFromVp(argc, vp);

Change the JS_SET_RVAL at the end of the function to use args.rval().setObject(*result) if you're going to use CallArgs, might as well complete the transition.

@@ +2718,3 @@
>      RootedObject referent(cx, nullptr);
> +    if (!JS_ValueToObject(cx, args.get(0), &referent))
> +        return false;

Maybe

    if (!args.get(0).isNullOrUndefined() && !JS::ToObject(cx, args[0], &referent))
        return false;

to get rid of a JS_ValueToObject call (the semantics of which I can never remember, because it's not a standard method like ToObject).

@@ +2722,2 @@
>      RootedObject proto(cx, nullptr);
> +    if (args.hasDefined(1) && !args.get(1).isNull()) {

|!args.get(1).isNullOrUndefined()| and |JS::ToObject| here as well.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Error: Failed to compile specified revision f7ad046f783f (maybe try another?)

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/e61603f64470
user:        Steve Fink
date:        Fri May 03 13:53:15 2013 -0700
summary:     Bug 868302 - Enable rooting LIFO assertions in DEBUG, r=terrence

Comment 6

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6b0aa2368e65

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/6b0aa2368e65

Comment 8

[Ioana (away)]

Reproduced with the 11/22 mozilla-central JS shell. Verified as fixed with the 03/25 mozilla-beta shell.