1298854 - Assertion failure: this->is<T>(), at js/src/jsobj.h:562

Status: RESOLVED FIXED

Description

[Gary Kwong [:gkw] [:nth10sd]]

The following testcase crashes on mozilla-central revision 4f72b1d05267 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

// jsfunfuzz-generated
options('strict_mode');
// Adapted from randomly chosen test: js/src/jit-test/tests/debug/RematerializedFrame-retval.js
var m = parseModule("\
    var g = newGlobal();\
    var dbg = new Debugger;\
    setInterruptCallback(function() {\
        dbg.addDebuggee(g);\
        dbg.getNewestFrame();\
        return true;\
    });\
    g.eval(\"(\" + function f() {\
        invokeInterruptCallback(function() {\
            f();\
        });\
    } + \")();\");\
");
m.declarationInstantiation();
m.evaluation();


Backtrace:

0   js-dbg-64-dm-clang-darwin-4f72b1d05267	0x0000000104c862fc js::EnvironmentIter::settle() + 2204 (jsobj.h:562)
1   js-dbg-64-dm-clang-darwin-4f72b1d05267	0x0000000104d23205 js::UnwindAllEnvironmentsInFrame(JSContext*, js::EnvironmentIter&) + 37 (Interpreter.cpp:1060)
2   js-dbg-64-dm-clang-darwin-4f72b1d05267	0x00000001049d462a js::jit::DebugEpilogue(JSContext*, js::jit::BaselineFrame*, unsigned char*, bool) + 186 (BaselineFrame.h:139)
3   js-dbg-64-dm-clang-darwin-4f72b1d05267	0x000000010481aa40 js::jit::HandleException(js::jit::ResumeFromException*) + 4944 (JitFrames.cpp:463)
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd]]

Created attachment 8786016 [details]
Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd]]

Due to skipped revisions, the first bad revision could be any of:

changeset:   https://hg.mozilla.org/mozilla-central/rev/cb6fc6d38f8d
user:        Shu-yu Guo
date:        Thu Aug 25 01:28:47 2016 -0700
summary:     Bug 1263355 - Rewrite the frontend: bindings. (r=jorendorff,Waldo)

changeset:   https://hg.mozilla.org/mozilla-central/rev/18bec78f348e
user:        Shu-yu Guo
date:        Thu Aug 25 01:28:47 2016 -0700
summary:     Bug 1263355 - Report memory metrics for Scopes. (r=njn)

Shu-yu, is bug 1263355 a likely regressor?

Comment 3

[Shu-yu Guo [:shu]]

Created attachment 8786112 [details] [diff] [review]
Fix hasInitialEnv computation for RematFrames.

Comment 4

[Shu-yu Guo [:shu]]

Not committing test case because it's too slow.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4585f2f66645
Fix hasInitialEnv computation for RematFrames. (r=jandem)

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4585f2f66645