1995949 - Assertion failure: argvWithoutThis[i].isUndefined(), at jit/VMFunctions.cpp:522

Status: RESOLVED DUPLICATE of bug 1995939

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

class C extends (function (x, y) {}) {
  static {
    new(new Proxy(this, {}));
  }
}

(gdb) bt
#0  0x00005555580c3343 in MOZ_CrashSequence (aAddress=0x0, aLine=522) at /home/msf2/shell-cache/js-dbg-64-linux-x86_64-cf779e134b73-592787/objdir-js/dist/include/mozilla/Assertions.h:237
#1  js::jit::InvokeFunction (cx=0x7ffff5e3c200, obj=..., constructing=<optimized out>, ignoresReturnValue=false, argc=<optimized out>, argv=0x7fffffffb4f0, rval=...)
    at /home/msf2/trees/firefox/js/src/jit/VMFunctions.cpp:522
#2  0x00000a95a51b941e in ?? ()
#3  0x00007fffffffb4a0 in ?? ()
#4  0x0000000000000000 in ?? ()
(gdb)

This commit morphed the assertion failure to its current form:

04830ff9bcb7-591657
04830ff9bcb739527f06a866510daddf3e5046fe is the first interesting commit
commit 04830ff9bcb739527f06a866510daddf3e5046fe
Author: Iain Ireland
Date:   Wed Oct 15 17:54:48 2025 +0000

    Bug 1993404: Adjust for arguments underflow in InvokeFunction r=spidermonkey-reviewers,jandem

    /snip

The following commit probably caused an assertion failure ( Assertion failure: IsConstructor(args.CallArgs::newTarget()) (provided new.target value must be a constructor), at vm/Interpreter.cpp:704 ) to first appear:

e277fc4fc606-590253
e277fc4fc6061cdbf973371a4c01e648e9fc5711 is the first interesting commit
commit e277fc4fc6061cdbf973371a4c01e648e9fc5711
Author: Iain Ireland
Date:   Mon Oct 6 20:44:10 2025 +0000

    Bug 1991223: Handle arguments underflow in AllocateSpaceForConstructAndPushNewTarget r=jandem

    The tricky part here is that we have no scratch registers available on x86 until after pushing newTarget, but if we need padding, it needs to be pushed before newTarget. The best appro
ach I could find for x86 was to unconditionally push newTarget twice, and then possibly overwrite the second copy with the last argument. This is a little suboptimal for non-x86 targets, b
ut for now I decided to use the same strategy on all platforms, to avoid two separate implementations of some fairly tricky code.

    Differential Revision: https://phabricator.services.mozilla.com/D267103

Run with --fuzzing-safe --no-threads --ion-eager, compile with AR=ar sh ~/trees/firefox/js/src/configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on gh rev cf779e134b734420732099f0c0953365a6c5eee5.

Iain, is bug 1993404 a likely regressor?

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1993404