495843 - Crash [@ js_Interpret] or "Assertion failure: cg->stackDepth == stackDepth, at ../jsemit.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

const x;[x]='';for(;[];){}

crashes TM opt without -j at js_Interpret and asserts TM dbg at Assertion failure: cg->stackDepth == stackDepth, at ../jsemit.cpp:3796

===

$ ./js-opt-tm-intelmac 
js> const x;[x]='';for(;[];){}
warning: internal error compiling typein: stack underflow at pc 14
warning: internal error compiling typein: stack underflow at pc 15
warning: internal error compiling typein: stack underflow at pc 16
warning: internal error compiling typein: stack underflow at pc 19
warning: internal error compiling typein: stack underflow at pc 20
warning: internal error compiling typein: stack underflow at pc 23
warning: internal error compiling typein: stack underflow at pc 26
Bus error
$ ./js-dbg-tm-intelmac 
js> const x;[x]='';for(;[];){}
Assertion failure: cg->stackDepth == stackDepth, at ../jsemit.cpp:3796
Trace/BPT trap

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 493760 :

The first bad revision is:
changeset:   28520:241dad2cc2e3
user:        Brendan Eich
date:        Tue May 19 18:40:55 2009 -0700
summary:     Bug 493760: the real fix for problem left in wake of patch for bug 493466 (r=mrbkap).

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Another testcase:

"" + new Function("const x;(g)({4:x}=[])")

$ ./js-opt-tm-intelmac 
js> "" + new Function("const x;(g)({4:x}=[])")
typein:1: warning: internal error compiling typein: stack underflow at pc 18
typein:1: warning: internal error compiling typein: stack underflow at pc 21
typein:1: warning: internal error compiling typein: stack underflow at pc 22
Segmentation fault
$ ./js-dbg-tm-intelmac 
js> "" + new Function("const x;(g)({4:x}=[])")
Assertion failure: cg->stackDepth == stackDepth, at ../jsemit.cpp:3796
Trace/breakpoint trap

Comment 3

[Damon Sicore (:damons)]

Assigning to bkap.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Shot in the dark

I don't know if this is right, but it seems to fix the assertion. The decompiler is still confused though:

js> (function() {const x;[x]='';})
function () {
    const x;
    [, ] = "";

Comment 5

[Jesse Ruderman]

The decompiler issue might bug 492010.

Comment 6

[Brendan Eich [:brendan]]

(In reply to comment #4)
> Created an attachment (id=381219) [details]
> Shot in the dark
> 
> I don't know if this is right, but it seems to fix the assertion. The
> decompiler is still confused though:
> 
> js> (function() {const x;[x]='';})
> function () {
>     const x;
>     [, ] = "";

You cut off the closing brace line, right? This is a valid decompilation and it is stable when round-tripped through eval.

Patch is good, thanks. Will stamp now.

/be

Comment 7

[Robert Sayre]

(In reply to comment #6)
> You cut off the closing brace line, right?

Yes, he did.

http://hg.mozilla.org/tracemonkey/rev/619278dc6389

Comment 8

[Ben Newman (:bnewman) (:benjamn)]

Per request of damons:
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/ee0c5ec5d68d

I'm assuming this also needs landing on mozilla-central...

Comment 9

[Ben Newman (:bnewman) (:benjamn)]

(In reply to comment #8)
> I'm assuming this also needs landing on mozilla-central...

Per my assumption:
http://hg.mozilla.org/mozilla-central/rev/0c053dca8ea6

Comment 10

[Ben Newman (:bnewman) (:benjamn)]

Apologies to mrbkap for accidentally crediting myself for this patch!

Comment 11

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/619278dc6389

Comment 12

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Verified fixed on trunk and 1.9.1 with testcase in comment 0 and debug builds like:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090604 Minefield/3.6a1pre ID:20090604215922

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre) Gecko/20090604 Shiretoko/3.5pre ID:20090604202448

Comment 13

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929