1353648 - Assertion failure: this->is<T>(), at js/src/jsobj.h:568

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision b043233ec04f (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

(function () {
    for (var i = 0; i < 2; i++) {
        try {
            for (let x in Array(-1)) {}
        } catch (e) {
            with({}) {}
        }
    }
})()

Backtrace:

#0  0x00000000005448a4 in JSObject::as<js::CallObject> (this=<optimized out>) at js/src/jsobj.h:568
#1  0x0000000000ad795c in js::EnvironmentIter::settle (this=this@entry=0x7ffe44e53b60) at js/src/vm/EnvironmentObject.cpp:1302
#2  0x0000000000ad7cb8 in js::EnvironmentIter::EnvironmentIter(JSContext*, js::AbstractFramePtr, unsigned char*, mozilla::detail::GuardObjectNotifier&&) (this=0x7ffe44e53b60, cx=0x7f2f85875000, frame=..., pc=0x7f2f85845335 <incomplete sequence \307>, _notifier=<unknown type in /home/gkwubu/shell-cache/js-dbg-64-dm-linux-b043233ec04f/js-dbg-64-dm-linux-b043233ec04f, CU 0x457e87e, DIE 0x47c1d95>) at js/src/vm/EnvironmentObject.cpp:1233
#3  0x0000000000e722ef in js::jit::FinishBailoutToBaseline (bailoutInfo=0x0) at js/src/jit/BaselineBailouts.cpp:1967
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/0a3a0f9eb773
user:        Ted Campbell
date:        Wed Feb 15 15:28:15 2017 -0500
summary:     Bug 1273858 - Ion-compile JSOP_FRESHENLEXICALENV/JSOP_RECREATELEXICALENV r=jandem

Ted, is bug 1273858 a likely regressor?

Comment 3

[Ted Campbell [:tcampbell]]

Yep, very likely is. I'll take a look at it.

Comment 4

[Ted Campbell [:tcampbell]]

Fixed in https://hg.mozilla.org/mozilla-central/rev/9590ce12459c