281487 - on JSOP_ARGDEC with debug: Assertion failure: map->vector && i < map->length

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Philipp Vogt]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

If you start the jsshell and enter:

tracing(true);
var a = function (i,j,k) {
  x = j--;
};
a(1,2,3);

you get an assertion on JSOP_ARGDEC:

js> tracing(true);
   1: 00008:  popv
  inputs: tracing(true) @ 1
  stack:
js> var a = function (i,j,k) {
  x = j--;
};
   2: 00000:  defvar "a"
  stack:
   2: 00003:  bindname "a"
  output: a @ 1
  stack: ({a:undefined})
   2: 00006:  anonfunobj (function (i, j, k) {x = j--;})
  output:
function (i, j, k) {
    x = j--;
}
 @ 2
  stack: ({a:undefined}) (function (i, j, k) {x = j--;})
   2: 00009:  setname "a"
  inputs: a,
function (i, j, k) {
    x = j--;
}
 @ 2
  output: a @ 1
  stack: (function (i, j, k) {x = j--;})
   2: 00012:  pop
  inputs: a @ 1
  stack:
js> a(1,2,3);
   5: 00000:  name "a"
  output: a @ 1
  stack: (function (i, j, k) {x = j--;})
   5: 00003:  pushobj
  output: [object global] @ 2
  stack: (function (i, j, k) {x = j--;}) ({a:(function (i, j, k) {x = j--;})})
   5: 00004:  one
  output: 1 @ 3
  stack: (function (i, j, k) {x = j--;}) ({a:(function (i, j, k) {x = j--;})}) 1

   5: 00005:  uint16 2
  output: 2 @ 4
  stack: (function (i, j, k) {x = j--;}) ({a:(function (i, j, k) {x = j--;})}) 1
 2
   5: 00008:  uint16 3
  output: 3 @ 5
  stack: (function (i, j, k) {x = j--;}) ({a:(function (i, j, k) {x = j--;})}) 1
 2 3
   5: 00011:  call 3
 @ 5
   3: 00000:  bindname "x"
  output: x @ 1
  stack: ({a:(function (i, j, k) {x = j--;})})
   3: 00003:  argdec 1
Assertion failure: map->vector && i < map->length, at jsatom.c:871



Reproducible: Always

Steps to Reproduce:
1. start jsshell.exe
2. activate tracing
3. call a function that decreases an argument

Actual Results:  
Assertion with a popup-box to send the errorinformation to ms ;-))

Expected Results:  
continue without assertion

It seems to happen when decompiling in jsinterp.c(5261):
 str = js_DecompileValueGenerator(cx, n, sp[n], NULL);
and then js_GetAtom in jsatom.c

Comment 1

[Brendan Eich [:brendan]]

More tracing badness?

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

js_DecompileValueGenerator failed to adapt long ago when JSOP_GETARG, etc.,
were added to jsopcode.tbl.

/be

Comment 3

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 174115 [details] [diff] [review]
fix

God, I love the decompiler. r=shaver

Comment 4

[Brendan Eich [:brendan]]

Fixed.

/be

Comment 5

[Bob Clary [:bc] (inactive)]

Checking in regress-281487.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-281487.js,v  <--  regress-281487.js
initial revision: 1.1
done

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.x and trunk. Note comment in test

<quote>This test requires a DEBUG build and will cause a false failure to be reported by jsDriver.pl since the tracing output will contain the string FAILED. This test only fails if it causes a crash.</quote>