Closed Bug 745360 Opened 12 years ago Closed 12 years ago

IonMonkey: Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted(),"

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla14

People

(Reporter: gkw, Assigned: nbp)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [Leave open after IonMonkey merge] [jsbugmon:update,ignore])

Crash Data

Attachments

(4 files)

Attached file stack
newGlobal('new-compartment').eval("eval.arguments")

asserts js debug shell on IonMonkey changeset e78cfa69741e without any CLI arguments at Assertion failure: isInterpreted(),

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   91388:2386dfe53a85
user:        Nicolas Pierron
date:        Fri Mar 23 20:30:57 2012 -0700
summary:     Rewrite fun_getProperty to handle Ion Frames (Bug 732853 part 2, r=dvander)
Crashes at js::StackFrame::isNonEvalFunctionFrame on mozilla-inbound rev 662c163ac088 instead.
Crash Signature: [@ js::StackFrame::isNonEvalFunctionFrame]
Summary: IonMonkey: "Assertion failure: isInterpreted()," → Crash [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted(),"
Crashes opt shell at js::ArgumentsObject::createUnexpected too. Seems to be a null deref.
Crash Signature: [@ js::StackFrame::isNonEvalFunctionFrame] → [@ js::StackFrame::isNonEvalFunctionFrame] [@ js::ArgumentsObject::createUnexpected]
Summary: Crash [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted()," → Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted(),"
The mozilla-inbound regression is likely to be bug 744670.
Blocks: 744670
Assignee: general → nicolas.b.pierron
Status: NEW → ASSIGNED
Attachment #614957 - Flags: review?(luke)
Attachment #614957 - Flags: review?(luke) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/dcb1ba052c35
Summary: Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted()," → IonMonkey: Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted(),"
Whiteboard: [Leave open after IonMonkey merge]
https://hg.mozilla.org/mozilla-central/rev/dcb1ba052c35
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla14
This bug should not be closed because it also affects IonMonkey. (see title & whiteboard)
Thanks for your concern.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Whiteboard: [Leave open after IonMonkey merge] → [Leave open after IonMonkey merge][jsbugmon:update]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 0e6d579045c8).
Crash Signature: [@ js::StackFrame::isNonEvalFunctionFrame] [@ js::ArgumentsObject::createUnexpected] → [@ js::StackFrame::isNonEvalFunctionFrame] [@ js::ArgumentsObject::createUnexpected]
Whiteboard: [Leave open after IonMonkey merge][jsbugmon:update] → [Leave open after IonMonkey merge] [jsbugmon:update,ignore]
(In reply to Christian Holler (:decoder) from comment #8)
> JSBugMon: The testcase found in this bug no longer reproduces (tried
> revision 0e6d579045c8).

The bug has been correctly merged, thanks for monitoring.
Status: REOPENED → RESOLVED
Crash Signature: [@ js::StackFrame::isNonEvalFunctionFrame] [@ js::ArgumentsObject::createUnexpected] → [@ js::StackFrame::isNonEvalFunctionFrame] [@ js::ArgumentsObject::createUnexpected]
Closed: 12 years ago12 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug745360.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: