945241 - Crash [@ visitReferences<js::MemoryTracingVisitor>] with TypedObject

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 84a5a5800bd3 (run with --fuzzing-safe):


var Object = TypedObject.Object;
var handle0 = Object.handle();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

This looks like a null-deref but the crash involves GC frames, so marking s-s.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, failed due to error (try manually).

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: regression window

Due to build breakage, the regression window is quite large.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Bug 898359 might be likely, though:

changeset:   http://hg.mozilla.org/mozilla-central/rev/5b797c0177d3
user:        Nicholas D. Matsakis
date:        Sun Sep 22 20:18:31 2013 -0400
summary:     Bug 898359 - Implement reference types in typed objects r=sfink

Nicholas, is bug 898359 a likely regressor?

Comment 6

[Steve Fink [:sfink] [:s:]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #5)
> Bug 898359 might be likely, though:
> 
> changeset:   http://hg.mozilla.org/mozilla-central/rev/5b797c0177d3
> user:        Nicholas D. Matsakis
> date:        Sun Sep 22 20:18:31 2013 -0400
> summary:     Bug 898359 - Implement reference types in typed objects r=sfink
> 
> Nicholas, is bug 898359 a likely regressor?

Yes.

Comment 7

[Steve Fink [:sfink] [:s:]]

Note that this only reproduces for me if I add an explicit gc() call at the end.

Comment 8

[Steve Fink [:sfink] [:s:]]

Attachment: stack

Comment 9

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 84a5a5800bd3 (run with --fuzzing-safe):


var Object = TypedObject.Object;
var handle0 = Object.handle();
gc();

Comment 10

[Niko Matsakis [:nmatsakis]]

I'll take a look -- presumably an easy fix relating to unattached handles.

Comment 11

[Andrew McCreight [:mccr8]]

Setting to sec-low because this looks like a null deref.  If it is something worse, please upgrade or clear the sec- rating.

Comment 12

[Niko Matsakis [:nmatsakis]]

Attachment: Bug945241.diff

Comment 13

[Steve Fink [:sfink] [:s:]]

Comment on attachment 8347169 [details] [diff] [review]
Bug945241.diff

Review of attachment 8347169 [details] [diff] [review]:
-----------------------------------------------------------------

That's the patch I used locally to stop it from crashing, but I wasn't sure if there was anything funky going on that would mean the a NULL mem was bad for some reason. That's why I left it for you. It makes sense that unattached Handles are a thing, though.

Comment 14

[Niko Matsakis [:nmatsakis]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7450803f061c

but I forgot the test case.

Comment 15

[Niko Matsakis [:nmatsakis]]

Try run (SM only, with test): https://tbpl.mozilla.org/?tree=Try&rev=d14c7c723941

Comment 16

[Niko Matsakis [:nmatsakis]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f542c81e7e31

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7450803f061c
https://hg.mozilla.org/mozilla-central/rev/f542c81e7e31

Comment 18

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.