1901412 - Assertion failure: !data()->args[i].isMagic(), at /root/src/js/src/vm/ArgumentsObject.h:395

Status: UNCONFIRMED

(Core :: JavaScript Engine, defect, P3)

Description

[Nils Bars]

Attachment: bug.js

Steps to reproduce:

Checkout commit 15778b8c32f8535624fff2af36fc669e65a9af3 and invoke the js shell as follows:

/root/js-spidermonkey-shell  --fuzzing-safe  <testcase>

Actual results:

Assertion failure: !data()->args[i].isMagic(), at /root/src/js/src/vm/ArgumentsObject.h:395

Comment 1

[Jan de Mooij [:jandem]]

Test below fails with --fast-warmup --no-threads.

The debugger creates an arguments object for the frame that has a JS_OPTIMIZED_OUT magic value for argument 0.

function f() {
    var dbg = newGlobal({newCompartment: true}).Debugger(this);
    dbg.getNewestFrame().older.eval(`arguments[0] = arguments`);
  }

class Cls {
    constructor(c) {
        for (var i = 0; i < 60; i++) {}
        f();
    }
}
new Cls(Cls);

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8246a4ba7eeb
user:        Jon Coppeard
date:        Mon Nov 13 16:03:20 2023 +0000
summary:     Bug 1864419 - Part 2: Add GCOwnedArray for arrays of GC data owned by GC things that may live in the nursery r=jandem

Jon, is bug 1864419 a likely regressor?

Comment 3

[Jon Coppeard (:jonco)]

Probably just the last patch to touch this code. Sounds like a debugger issue from previous comments.