716713 - "Assertion failure: ss->top >= 2," or "Assertion failure: top != 0," or "Assertion failure: newtop <= oldtop,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

f = (function() {
    @o()
}).g()

asserts js debug shell on m-c changeset c713003d3226 without any CLI arguments at Assertion failure: ss->top >= 2,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   84036:7ab4f1ebc7cc
user:        Brian Hackett
date:        Mon Jan 09 06:29:50 2012 -0800
summary:     Backout 54cd89b0f1fa (bug 712714 backout).  Talos will probably report fake regressions for this patch, do not back out for this reason.

Just to be sure:

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   83898:78d17e22a223
parent:      83892:0ac1cbff2a67
user:        Brian Hackett
date:        Thu Jan 05 11:08:38 2012 -0800
summary:     Remove JOF_CALLOP, bug 712714. r=dvander

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Another testcase asserting identically as the one in comment 0:

uneval(function() {
    @o()
})

A variant asserts at:

uneval(function() {
    for (b in x) {
        @o()
    }
})

Assertion failure: top != 0,

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    for (let b in []) {
        ( * )()
    }
}).f()

A variant that does not involve "@" asserts at Assertion failure: newtop <= oldtop,

Comment 3

[Jesse Ruderman]

Both (*) and (@o) are E4X things, fwiw.

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

JSOP_CALLXMLNAME still pushes two values, and needed a placeholder value when decompiling.

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/246f9b345686

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

http://hg.mozilla.org/mozilla-central/rev/246f9b345686/

Comment 8

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/e4x/bug716713.js.