429264 - "Assertion failure: top < ss->printer->script->depth" with "for", trap()

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Pasting this into the js shell:

function f() { for(; 1; ) { } }
trap(f, 0, "");
f

triggers:

Assertion failure: top < ss->printer->script->depth, at jsopcode.c:882

Comment 1

[Brian Crowder]

Does the patch in bug 422137 resolve this?

Comment 2

[Brian Crowder]

The patch in bug 422137 does -not- resolve this.  I -think- the issue is to do with some confusion over a source note referring to what has now been rewritten as a JSOP_TRAP.

Comment 3

[Brian Crowder]

The decompiler is confused by the use of source-notes here.  We are definitely not doing the right thing in the JSOP_TRAP case for bytecodes accompanied by src-notes (JSOP_NOP, in this case).  Is Igor's suggestion from bug 422137 comment 50 more expedient than more whack-a-mole here?

Comment 4

[Brian Crowder]

This is fixed by my WIP patch from bug 422137.

Comment 5

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/extensions/regress-429264.js

I'll check in when the tree reopens

Comment 6

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-429264.js,v  <--  regress-429264.js
initial revision: 1.1

Note to self: When run on x86_64 in the test framework this exits with signal 6 or 7 but I can't reproduce it using jsDriver or just plain vanilla js.

Comment 7

[Brendan Eich [:brendan]]

Bug on file for apparent 64-bit-only bug leading to crash? What signals are 6 and 7 according to `man signal` on that system?

/be

Comment 8

[Bob Clary [:bc] (inactive)]

re bug, not yet. I want to reboot and see if my flakiness goes away after a full rm objdirs and complete rebuilt.

kill -l  6) SIGABRT      7) SIGBUS 

Comment 9

[Bob Clary [:bc] (inactive)]

v 1.9.0. the signal issues on centos5 x86_64 are gone.