1851135 - Assertion failure: whyMagic() == why

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[anbu]

Steps to reproduce:

SpiderMonkey version:
commit: 8f09f6a6ff0d8b6ea75a1e1279a06ba02479578c

Test case

function foo(a1, a2, a3) {

    let x = a1.hasOwnProperty(foo);
    
    function bar(a15) {
        const ret = `
            x = foo;
        `;
        return ret;
    }
    
    a3.toString = bar;
    
    for (let i = 0; i < 100; i++) {
        for (let j = 0; j < 100; j++) {
            this.isValidJSON(String.fromCharCode());
        }
    }
    
    class Baz {}
    
    const s = a3.toString(a2);
    const p = new Baz();
    
    function Bling() {}
    
    const b = new Bling();
    b.sameZoneAs = b;
    
    const t = this.newGlobal(b).Debugger;
    t(p).getNewestFrame().eval(s);
    
    return bar;
}

foo(this, foo, foo);

Exec:

./dist/bin/js --baseline-warmup-threshold=50 --ion-warmup-threshold=200 --ion-check-range-analysis --ion-extra-checks ./test.js

Actual results:

Error:

Assertion failure: whyMagic() == why, at /media/Store/Project/js-engines/SpiderMonkey/gecko-dev-build/debug_8f09f6_20230901/dist/include/js/Value.h:868

Comment 1

[Iain Ireland [:iain]]

We added two calls to .isMagic(JS_UNINITIALIZED_LEXICAL) in bug 1845270, which will crash if they see a different magic value. Bug 1847360 fixed one of those; this is the other one.

Thanks for the report!

Comment 2

[Iain Ireland [:iain]]

Attachment: Bug 1851135: Fix magic value check r=mgaudet

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2b828cf6d7a9
Fix magic value check r=mgaudet

Comment 4

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/2b828cf6d7a9