1528267 - Assertion failure: val.isNumber() (-1 only callable on result of JSOP_TONUMERIC), at js/src/vm/Interpreter-inl.h:421

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision f0ea53f47215 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off --ion-offthread-compile=off):

const one = BigInt(1);
one--;

Backtrace:

received signal SIGSEGV, Segmentation fault.
js::DecOperation (cx=<optimized out>, res=..., val=...) at js/src/vm/Interpreter-inl.h:421
#0  js::DecOperation (cx=<optimized out>, res=..., val=...) at js/src/vm/Interpreter-inl.h:421
#1  Interpret (cx=0x555556b0a8d8, state=...) at js/src/vm/Interpreter.cpp:4316
[...]
#10 0x000055555582c6eb in Shell (envp=<optimized out>, op=0x7fffffffd960, cx=<optimized out>) at js/src/shell/js.cpp:10387
#11 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:10973
rax	0x555557c1f280	93825032909440
rbx	0x555556b0a8d8	93825014999256
rcx	0x7ffff6c1c2dd	140737333281501
rdx	0x0	0
rsi	0x7ffff6eeb770	140737336227696
rdi	0x7ffff6eea540	140737336223040
rbp	0x7fffffffce50	140737488342608
rsp	0x7fffffffc880	140737488341120
r8	0x7ffff6eeb770	140737336227696
r9	0x7ffff7fe6cc0	140737354034368
r10	0x58	88
r11	0x7ffff6b927a0	140737332717472
r12	0x7ffff4dd00b0	140737301512368
r13	0x555557b86820	93825032284192
r14	0x7ffff4dd00b8	140737301512376
r15	0x7fffffffcd60	140737488342368
rip	0x5555558e4743 <Interpret(JSContext*, js::RunState&)+51667>
=> 0x5555558e4743 <Interpret(JSContext*, js::RunState&)+51667>:	movl   $0x0,0x0
   0x5555558e474e <Interpret(JSContext*, js::RunState&)+51678>:	ud2

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/d65cae66e331
user: Andy Wingo
date: Wed Feb 13 10:48:51 2019 +0000
summary: Bug 1519135 - Replace JSOP_POS in ++/-- with JSOP_TONUMERIC r=terpri,jandem

Andy, is bug 1519135 a likely regressor?

Comment 3

[Christian Holler (:decoder)]

Will likely be fixed by bug 1526309.

Comment 4

[Andy Wingo [:wingo]]

Indeed, fixed by bug 1526309.