560998 - Assertion failure: entry->vword.toObject() == JSVAL_TO_OBJECT(v)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

for (let j = 0; j < 4; ++j) {
  function g() { j; }
  g();
}

Assertion failure: entry->vword.toObject() == JSVAL_TO_OBJECT(v), at ../jsinterp.cpp:2184

Crashes when using just the interpreter, no -j or -m!
TM branch rev 5b05b75cd402.

I discovered this using a new technique (not jsfunfuzz).

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 471214:

The first bad revision is:
changeset:   32130:842e6c09e35a
user:        Brendan Eich
date:        Thu Sep 03 14:41:19 2009 -0700
summary:     Join lambdas assigned or initialized as methods to the compiler-created function object if we can, with a read barrier to clone on method value extractions other than call expressions (471214, r=jorendorff).

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

fwiw, bug 471214 was not landed on 1.9.2 so this should not affect Firefox 3.6.x and before.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This bug along with bug 560101 are being hit somewhat frequently by jsfunfuzz, especially after jsfunfuzz was improved to hit this bug. :)

Comment 4

[Jason Orendorff [:jorendorff]]

The second time through the loop, the global is already branded, and JSOP_DEFFUN ends up in js_DefineNativeProperty to change the value of g, a function-valued global property.

This should change the global shape, but it doesn't.

Comment 5

[Jason Orendorff [:jorendorff]]

Attachment: v1

The fix is in the first hunk. The rest is tidying up and tests.

Comment 6

[Brendan Eich [:brendan]]

Comment on attachment 442548 [details] [diff] [review]
v1

I had plans for toval; no worries, it can come back if needed.

/be

Comment 7

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/539d04cccb8b

I have to admit this "new technique" sounds ominous.

Comment 8

[Brendan Eich [:brendan]]

Yeah, don't tease, Jesse. We're all expecting a new, fully operational, space-squid-obvious, Death Star. IT'S A TRAP!!

/be

Comment 9

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/539d04cccb8b

Comment 10

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-560998-1.js.