881461 - Assertion failure: index >= size_t(pcstack.depth()), at jsopcode.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

for (var n = 0; n < 9;
({
    __proto__: z,
    set c(a) {}
}), ++n) {
    z = Proxy.create({}, (function(){}))
}

asserts js debug shell on m-c changeset 9115d8b717e1 with --baseline-eager --no-ion at Assertion failure: index >= size_t(pcstack.depth()), at jsopcode.cpp

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/005c4f452f1e
user:        Jan de Mooij
date:        Thu May 30 18:51:03 2013 +0200
summary:     Bug 876670 - Refactor object literal getter/setter bytecode and implement it in the baseline compiler. r=bhackett

This iteration took 333.675 seconds to run.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

Bleh, INITPROP_GETTER/SETTER and INITELEM_* have to leave the values on the stack for the decompiler.

Comment 3

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f9e6eb0d5239

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f9e6eb0d5239

Comment 5

[Bob Clary [:bc] (inactive)]

http://www.jetsetter.com/?globalnav_referrer=women shows this assert on windows, linux aurora. mozregression shows nightly was fixed in the time frame this landed on m-c.

crashed opt about 5-10% of the time with bad dumps.

bp-5b8976c4-9125-47db-a80e-0cbe72130719
bp-cb2c513d-9105-4feb-abaf-cec7f2130719

Is this really fixed on aurora?

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> Is this really fixed on aurora?

Supposedly, yes:

http://hg.mozilla.org/releases/mozilla-aurora/rev/f9e6eb0d5239 shows the patch in comment 4 landed on aurora. Perhaps you're seeing a different bug?

Comment 7

[Bob Clary [:bc] (inactive)]

Attachment: jetsetter stack

I saw that. The stack is 'similar' and definitely doesn't involve proxy... A saved version of the page doesn't reproduce unfortunately, so reducing it will be problematic.