Last Comment Bug 569384 - TM: Crash [@ JSObject::dropProperty] or [@ js::TraceRecorder::record_JSOP_IN] or "Assertion failure: status == ARECORD_ERROR,"
: TM: Crash [@ JSObject::dropProperty] or [@ js::TraceRecorder::record_JSOP_IN]...
Status: RESOLVED FIXED
: [ccbr][sg:critical], fixed-in-tracemo...
: assertion, crash, regression, testcase, testcase-wanted
Product: Core
Classification: Components
Component: JavaScript Engine
: Trunk
: All All
: P2 critical (vote)
: ---
Assigned To: Andreas Gal :gal
: general
:
:
: jsfunfuzz 567068
  Show dependency treegraph
 
Reported: 2010-06-01 10:27 PDT by Gary Kwong [:nth10sd]
Modified: 2011-03-29 19:25 PDT (History)
9 users (show)
See Also:
Crash Signature:
[@ JSObject::dropProperty] [@ js::TraceRecorder::record_JSOP_IN]
  ---
  ---
  ---
  ---
  ---
  ---
  ---
  ---
  ---
  betaN+
  ---
  .14+
  .14-fixed
  ---
  unaffected


Attachments
patch (937 bytes, patch)
2010-06-01 14:52 PDT, Andreas Gal :gal
luke: review+
Details | Diff | Splinter Review

Summon comment box

Description Gary Kwong [:nth10sd] 2010-06-01 10:27:30 PDT
for (b = 0; b < 1; ++b) {
    var d = b
}
(function () {
    x = Proxy.create(function () {
        return {
            getPropertyDescriptor: function () {
                +""
            }
        }
    }(), 5)
}())
for (a = 0; a < 3; ++a) {
    if (a == 1) {
        d in x
    }
}

crashes js opt shell with -j on TM tip at JSObject::dropProperty and asserts js debug shell with -j on TM tip at Assertion failure: status == ARECORD_ERROR, at ../jsops.cpp:7

s-s because this seems like a scary address (prior to reduction the edx instruction was at a weird 0x128 location). Assuming [sg:critical?] unless otherwise noted.

Program received signal SIGSEGV, Segmentation fault.
0x080bfef7 in JSObject::dropProperty(JSContext*, JSProperty*) ()
(gdb) bt
#0  0x080bfef7 in JSObject::dropProperty(JSContext*, JSProperty*) ()
#1  0x08216644 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) x/i $eip
=> 0x80bfef7 <_ZN8JSObject12dropPropertyEP9JSContextP10JSProperty+7>:	mov    (%edx),%eax
(gdb) x/b $edx
0x1:	Cannot access memory at address 0x1
Comment 1 Gary Kwong [:nth10sd] 2010-06-01 10:30:20 PDT
(Also assuming related to harmony:proxies, setting dependency)
Comment 2 Andreas Gal :gal 2010-06-01 13:38:08 PDT
#0  0x00000000014021c0 in ?? ()
Cannot access memory at address 0x14021c0
#1  0x00000001001a3007 in js::TraceRecorder::record_JSOP_IN (this=0x100415410) at ../jstracer.cpp:14019
#2  0x00000001001a73e7 in js::TraceRecorder::monitorRecording (this=0x100415410, op=JSOP_IN) at jsopcode.tbl:281
#3  0x000000010008557d in js_Interpret (cx=0x10083c800) at jsops.cpp:78
#4  0x00000001000ae19a in js_Execute (cx=0x10083c800, chain=0x101402000, script=0x100414f90, down=0x0, flags=0, result=0x0) at jsinterp.cpp:837
#5  0x00000001000123af in JS_ExecuteScript (cx=0x10083c800, obj=0x101402000, script=0x100414f90, rval=0x0) at ../jsapi.cpp:4831
#6  0x000000010000a168 in Process (cx=0x10083c800, obj=0x101402000, filename=0x7fff5fbffa90 "x2.js", forceTTY=0) at ../../shell/js.cpp:422
#7  0x000000010000adad in ProcessArgs (cx=0x10083c800, obj=0x101402000, argv=0x7fff5fbff938, argc=2) at ../../shell/js.cpp:836
#8  0x000000010000af28 in main (argc=2, argv=0x7fff5fbff938, envp=0x7fff5fbff950) at ../../shell/js.cpp:5082
Comment 3 Andreas Gal :gal 2010-06-01 13:40:00 PDT
not proxy related, just proxy triggered, probably needs branch fixing too, patch soon
Comment 4 Andreas Gal :gal 2010-06-01 14:52:34 PDT
Created attachment 448619 [details] [review]
patch
Comment 5 Luke Wagner [:luke] 2010-06-01 15:06:02 PDT
Comment on attachment 448619 [details] [review]
patch

Ew, lame; thanks for finding and fixing that.
Comment 6 Andreas Gal :gal 2010-06-01 15:46:01 PDT
http://hg.mozilla.org/tracemonkey/rev/66cee22c2706
Comment 7 Gary Kwong [:nth10sd] 2010-06-03 04:47:07 PDT
for (let n = 0; n < 7; ++n) {
    x = Proxy.create(function() {
        return {
            getPropertyDescriptor: function() {
                + ""
            }
        }
    } (), /x/)
}
for (z = 0; z < 5; ++z) {
    var a = z
}
for (var m = 0; m < 9; ++m) {
    if (m % 5 == 0) {} else {
        print(let(y = a in x) 7)
    }
}

is a 64-bit crash testcase (both in debug and opt shells) that got fixed by this patch, and it also crashes at js::TraceRecorder::record_JSOP_IN
Comment 9 Daniel Veditz 2011-01-10 13:17:31 PST
a non-proxy testcase that could be used to verify the branches would be great. The patch itself needs only minor merging for the branches (Macro/#define name changes).
Comment 10 Andreas Gal :gal 2011-01-18 12:41:11 PST
The bug doesn't exist in 1.9.1 (I tried the test case on 1.9.1, no crash). Landed on 1.9.2.

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/98467bef1347
Comment 11 Al Billings [:abillings] 2011-01-20 17:42:09 PST
(In reply to comment #0)
> for (b = 0; b < 1; ++b) {
>     var d = b
> }
> (function () {
>     x = Proxy.create(function () {
>         return {
>             getPropertyDescriptor: function () {
>                 +""
>             }
>         }
>     }(), 5)
> }())
> for (a = 0; a < 3; ++a) {
>     if (a == 1) {
>         d in x
>     }
> }

When I run this in my own 1.9.2 debug build (pre-fix) or 1.9.2.13, I get "ReferenceError on line 5: Proxy is not defined".

I'm not a JS shell expert but I expect I'm doing something wrong here.
Comment 12 Andreas Gal :gal 2011-01-20 17:44:12 PST
1.9.2 doesn't have proxies. You would need some other non-native object to make this happen (i.e. liveconnect).
Comment 13 Al Billings [:abillings] 2011-01-25 15:24:05 PST
Marking this at NTD (nothing to do) for QA for branch since there are no steps to reproduce or testcases.

Note You need to log in before you can comment on or make changes to this bug.