Assertion failure: !lazy->hasInnerFunctions(), at js/src/vm/JSScript.cpp:325
Categories
(Core :: JavaScript Engine, defect, P1)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr68 | --- | unaffected |
firefox72 | --- | unaffected |
firefox73 | --- | wontfix |
firefox74 | --- | fixed |
People
(Reporter: decoder, Assigned: tcampbell)
References
(Regression)
Details
(4 keywords, Whiteboard: [jsbugmon:])
Attachments
(2 files)
The following testcase crashes on mozilla-central revision 20200106-9d401beea71d (build with --enable-debug, run with --fuzzing-safe --no-threads):
function evalWithCache(code) {
code = cacheEntry(code);
evaluate(code, { saveIncrementalBytecode: { value: true } });
}
function f() {}
test = (function () {
function f() {
(function () {})
};
return "var obj = { x : 2 };" + f.toSource() + "; f()";
})(0, f.length);
evalWithCache(test);
Backtrace:
received signal SIGSEGV, Segmentation fault.
#0 0x0000555555c6984c in mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRScript<(js::XDRMode)0>(js::XDRState<(js::XDRMode)0>*, JS::Handle<js::Scope*>, JS::Handle<js::ScriptSourceObject*>, JS::Handle<JSObject*>, JS::MutableHandle<JSScript*>) ()
#1 0x0000555555c0fc8b in mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRInterpretedFunction<(js::XDRMode)0>(js::XDRState<(js::XDRMode)0>*, JS::Handle<js::Scope*>, JS::Handle<js::ScriptSourceObject*>, JS::MutableHandle<JSFunction*>) ()
#2 0x0000555555e733bf in js::XDRState<(js::XDRMode)0>::codeFunction(JS::MutableHandle<JSFunction*>, JS::Handle<js::ScriptSourceObject*>) ()
#3 0x0000555555c7a9e4 in js::ScriptSource::xdrEncodeFunction(JSContext*, JS::Handle<JSFunction*>, JS::Handle<js::ScriptSourceObject*>) ()
#4 0x0000555555c16ed8 in JSFunction::delazifyLazilyInterpretedFunction(JSContext*, JS::Handle<JSFunction*>) ()
#5 0x00005555557b4e04 in JSFunction::getOrCreateScript(JSContext*, JS::Handle<JSFunction*>) ()
#6 0x0000555555c167c8 in JSFunction::delazifyLazilyInterpretedFunction(JSContext*, JS::Handle<JSFunction*>) ()
#7 0x00005555557b4e04 in JSFunction::getOrCreateScript(JSContext*, JS::Handle<JSFunction*>) ()
#8 0x00005555558e4772 in Interpret(JSContext*, js::RunState&) ()
#9 0x00005555558da371 in js::RunScript(JSContext*, js::RunState&) ()
#10 0x00005555558f2975 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) ()
#11 0x00005555558f2fcd in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) ()
#12 0x0000555555afaad7 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::Value*) ()
#13 0x0000555555afaf3e in ExecuteScript(JSContext*, JS::Handle<JS::StackGCVector<JSObject*, js::TempAllocPolicy> >, JS::Handle<JSScript*>, JS::Value*) ()
#14 0x000055555578f81c in Evaluate(JSContext*, unsigned int, JS::Value*) ()
#15 0x00005555558f02e2 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) ()
[...]
#26 0x0000555555772c51 in main ()
rax 0x555556ed2e36 93825018965558
rbx 0x2 2
rcx 0x555557f0e838 93825035987000
rdx 0x0 0
rsi 0x7ffff68b5770 140737329715056
rdi 0x7ffff68b4540 140737329710400
rbp 0x7fffffffaa20 140737488333344
rsp 0x7fffffffa850 140737488332880
r8 0x7ffff68b5770 140737329715056
r9 0x7ffff7fe5d00 140737354030336
r10 0x58 88
r11 0x7ffff655c7a0 140737326204832
r12 0x7ffff58f88a0 140737313212576
r13 0x7fffffffa888 140737488332936
r14 0x7ffff5827000 140737312354304
r15 0x80007ffff5879100 -9223231299542085376
rip 0x555555c6984c <mozilla::Result<mozilla::Ok, JS::TranscodeResult> js::XDRScript<(js::XDRMode)0>(js::XDRState<(js::XDRMode)0>*, JS::Handle<js::Scope*>, JS::Handle<js::ScriptSourceObject*>, JS::Handle<JSObject*>, JS::MutableHandle<JSScript*>)+4028>
=> 0x555555c6984c <_ZN2js9XDRScriptILNS_7XDRModeE0EEEN7mozilla6ResultINS2_2OkEN2JS15TranscodeResultEEEPNS_8XDRStateIXT_EEENS5_6HandleIPNS_5ScopeEEENSB_IPNS_18ScriptSourceObjectEEENSB_IP8JSObjectEENS5_13MutableHandleIP8JSScriptEE+4028>: movl $0x145,0x0
0x555555c69857 <_ZN2js9XDRScriptILNS_7XDRModeE0EEEN7mozilla6ResultINS2_2OkEN2JS15TranscodeResultEEEPNS_8XDRStateIXT_EEENS5_6HandleIPNS_5ScopeEEENSB_IPNS_18ScriptSourceObjectEEENSB_IP8JSObjectEENS5_13MutableHandleIP8JSScriptEE+4039>: callq 0x5555557f7af2 <abort>
autobisectjs shows this is probably related to the following changeset:
The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/9160b2617014
user: Ted Campbell
date: Mon Dec 09 17:16:06 2019 +0000
summary: Bug 1566466 - Clean up relazification conditions. r=jandem
Ted, is bug 1566466 a likely regressor?
Updated•5 years ago
|
Assignee | ||
Updated•5 years ago
|
Updated•5 years ago
|
Updated•5 years ago
|
Updated•5 years ago
|
Updated•5 years ago
|
Comment 2•5 years ago
|
||
Assignee | ||
Comment 3•5 years ago
|
||
Updates the yaml file so that it generates the currently checked in output
artifacts. These are recent regressions but straightforward to fix.
Assignee | ||
Comment 4•5 years ago
|
||
Since the bytecode emitter may remove inner functions, we can end up with
inconsistent definitions of the flag. Instead compute this in the parser
using the conservative definition.
Depends on D61934
Comment 6•5 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/fecd58af98ac
https://hg.mozilla.org/mozilla-central/rev/64f9ecf63927
Updated•5 years ago
|
Description
•