326467 - Assertion failure: (uint32)slot < JS_MIN(((obj)->map)->freeslot, ((obj)->map)->nslots), at c:/mozsource/mozilla/js/src/jsinterp.c:4495

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Alex Vincent [:WeirdAl]]

NTDLL! 7c901230()
js_Interpret(JSContext * 0x01ed32a8, unsigned char * 0x033ba81d, long * 0x0012c4a4) line 4495 + 93 bytes
js_Execute(JSContext * 0x01ed32a8, JSObject * 0x01fb9c18, JSScript * 0x033ba7d8, JSStackFrame * 0x0012d070, unsigned int 0x00000020, long * 0x0012c620) line 1480 + 19 bytes
obj_eval(JSContext * 0x01ed32a8, JSObject * 0x02cf5b88, unsigned int 0x00000002, long * 0x037d2c34, long * 0x0012c620) line 1270 + 27 bytes
js_Invoke(JSContext * 0x01ed32a8, unsigned int 0x00000002, unsigned int 0x00000000) line 1230 + 23 bytes
js_Interpret(JSContext * 0x01ed32a8, unsigned char * 0x02d289b9, long * 0x0012d0e0) line 3792 + 15 bytes
js_Invoke(JSContext * 0x01ed32a8, unsigned int 0x00000002, unsigned int 0x00000006) line 1254 + 19 bytes
fun_apply(JSContext * 0x01ed32a8, JSObject * 0x02bb2620, unsigned int 0x00000002, long * 0x037d2bd0, long * 0x0012d224) line 1656 + 15 bytes
js_Invoke(JSContext * 0x01ed32a8, unsigned int 0x00000002, unsigned int 0x00000000) line 1230 + 23 bytes
js_Interpret(JSContext * 0x01ed32a8, unsigned char * 0x01fa90b5, long * 0x0012dce4) line 3792 + 15 bytes
js_Invoke(JSContext * 0x01ed32a8, unsigned int 0x00000003, unsigned int 0x00000000) line 1254 + 19 bytes
js_Interpret(JSContext * 0x01ed32a8, unsigned char * 0x02c30548, long * 0x0012e754) line 3792 + 15 bytes
js_Invoke(JSContext * 0x01ed32a8, unsigned int 0x00000001, unsigned int 0x00000002) line 1254 + 19 bytes
js_InternalInvoke(JSContext * 0x01ed32a8, JSObject * 0x0327c490, long 0x030344a8, unsigned int 0x00000000, unsigned int 0x00000001, long * 0x0012e950, long * 0x0012e94c) line 1331 + 20 bytes
JS_CallFunctionValue(JSContext * 0x01ed32a8, JSObject * 0x0327c490, long 0x030344a8, unsigned int 0x00000001, long * 0x0012e950, long * 0x0012e94c) line 4174 + 31 bytes
nsJSContext::CallEventHandler(JSObject * 0x0327c490, JSObject * 0x030344a8, unsigned int 0x00000001, long * 0x0012e950, long * 0x0012e94c) line 1424 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x0320e0f0, nsIDOMEvent * 0x03a81400) line 186 + 54 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x03514fe8, nsIDOMEventListener * 0x0320e0f0, nsIDOMEvent * 0x03a81400, nsIDOMEventTarget * 0x03a36d80, unsigned int 0x00000004, unsigned int 0x00000002) line 1653 + 16 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x036439d0, nsPresContext * 0x009f78c0, nsEvent * 0x0012f73c, nsIDOMEvent * * 0x0012f044, nsIDOMEventTarget * 0x03a36d80, unsigned int 0x00000002, nsEventStatus * 0x0012f568) line 1760
nsXULElement::HandleDOMEvent(nsPresContext * 0x009f78c0, nsEvent * 0x0012f73c, nsIDOMEvent * * 0x0012f044, unsigned int 0x00000002, nsEventStatus * 0x0012f568) line 1885
nsXULElement::HandleDOMEvent(nsPresContext * 0x009f78c0, nsEvent * 0x0012f73c, nsIDOMEvent * * 0x0012f044, unsigned int 0x00000002, nsEventStatus * 0x0012f568) line 1904 + 60 bytes
nsGenericElement::HandleDOMEvent(nsPresContext * 0x009f78c0, nsEvent * 0x0012f73c, nsIDOMEvent * * 0x0012f044, unsigned int 0x00000007, nsEventStatus * 0x0012f568) line 2052 + 60 bytes
nsHTMLInputElement::HandleDOMEvent(nsPresContext * 0x009f78c0, nsEvent * 0x0012f73c, nsIDOMEvent * * 0x00000000, unsigned int 0x00000001, nsEventStatus * 0x0012f568) line 1360 + 31 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f73c, nsIView * 0x01fa3028, unsigned int 0x00000001, nsEventStatus * 0x0012f568) line 6076 + 52 bytes
PresShell::HandleEvent(PresShell * const 0x01fa35f8, nsIView * 0x01fa3028, nsGUIEvent * 0x0012f73c, nsEventStatus * 0x0012f568) line 5851 + 25 bytes
nsViewManager::HandleEvent(nsView * 0x01fa3028, nsPoint {...}, nsGUIEvent * 0x0012f73c, int 0x00000000) line 1675
nsViewManager::DispatchEvent(nsViewManager * const 0x0209f2c8, nsGUIEvent * 0x0012f73c, nsEventStatus * 0x0012f68c) line 1628 + 37 bytes
HandleEvent(nsGUIEvent * 0x0012f73c) line 176
nsWindow::DispatchEvent(nsWindow * const 0x01fa30fc, nsGUIEvent * 0x0012f73c, nsEventStatus & nsEventStatus_eIgnore) line 1169 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f73c) line 1190
nsWindow::DispatchKeyEvent(unsigned int 0x00000083, unsigned short 0x0000, unsigned int 0x0000000d, long 0x001c0001, unsigned int 0x00000000) line 3382 + 15 bytes
nsWindow::OnKeyDown(unsigned int 0x0000000d, unsigned int 0x0000001c, long 0x001c0001) line 3520
nsWindow::ProcessMessage(unsigned int 0x00000100, unsigned int 0x0000000d, long 0x001c0001, long * 0x0012fc8c) line 4463 + 38 bytes
nsWindow::WindowProc(HWND__ * 0x0010051c, unsigned int 0x00000100, unsigned int 0x0000000d, long 0x001c0001) line 1358 + 27 bytes
USER32! 77d48734()
USER32! 77d48816()
USER32! 77d489cd()
USER32! 77d48a10()
nsAppShell::Run(nsAppShell * const 0x00a1b4e8) line 135
nsAppStartup::Run(nsAppStartup * const 0x00a534a0) line 208
main1(int 0x00000002, char * * 0x002a2638, nsISupports * 0x009e5948) line 1248 + 32 bytes
main(int 0x00000002, char * * 0x002a2638) line 1736 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 7c816d4f()

Steps to reproduce:
(1) seamonkey -venkman
(2) In the Venkman console, enter the line:

for (var prop in ({1:1})) {void(prop)}

Expected results:  none.

Actual results: crash.

Thanks to timeless for helping reduce the testcase.

Other variants leading to the crash:

var prop = null; for (prop in ({1:1})) {void(prop)}

Variants NOT crashing:

var prop = null;
for (prop in ({1:1}) {void(prop)}

var prop; for (prop in ({1:1})) {void(prop)} // ReferenceError: prop is not defined @ <x-jsd:interactive-session> 1

This crash happens in Venkman; it does not happen in xpcshell.

Comment 1

[Alex Vincent [:WeirdAl]]

The fixes for bug 325960 threw off the line numbers in my stack.  I'll retest as soon as I can to get an up-to-date build.

Comment 2

[Alex Vincent [:WeirdAl]]

Attachment: updated stack

This is current as of Wed Feb 8 15:38:29 PST 2006

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

The most reduced testcase that works in the shell that I've found so far:
js> eval('for(var prop in {1:1})prop;', {})
Assertion failure: slot < fp->nvars, at jsinterp.c:4576

The assertion is caused (I think) by the optimizer and the compiler getting confused as to what the current scopeobj and what the current varobj is, but I haven't traced far enough to prove that.

Comment 4

[Alex Vincent [:WeirdAl]]

Peanut gallery observation:  the top source-code frame on the stack is slightly different... but the rest is similar.  So that's a different assertion failure.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

It may be a different assertion, but it's the same bug, simply being caught earlier. I'm working on a fix.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

This fixes the assertion, but leaves a question about whether we'll ever use the wrong fp when eval'ing. I claim it will, since I hit an assertion that I added earlier. But that's a seperate bug that I'll look at later.

Comment 7

[Brendan Eich [:brendan]]

Comment on attachment 211797 [details] [diff] [review]
Proposed fix

>+        for (; oldfp && (oldfp->flags & JSFRAME_SPECIAL); oldfp = oldfp->down)
>+            continue;

This is really a while loop, obfuscated:

        while (oldfp && (oldfp->flags & JSFRAME_SPECIAL))
            oldfp = oldfp->down;

Let's botch that assert you had in the early return case that oldfp wasn't "special", and figure out what was going on there.

/be

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Better fix

This makes sure that we always do the loop for Variables, since it doesn't do it anymore.

Comment 9

[Brendan Eich [:brendan]]

Comment on attachment 212679 [details] [diff] [review]
Better fix

>+    /*
>+     * Always create a new fp if the current frame is special to be sure to give
>+     * Variables the right variables object to play with.

"Always push a new frame if the current frame is special, so that Variables gets the correct variables object: the one from the special frame's caller."

Looks good otherwise -- thanks for taking this on!

/be

Comment 10

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 11

[Bob Clary [:bc] (inactive)]

Checking in regress-326467.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-326467.js,v  <--  regress-326467.js
initial revision: 1.1

Comment 12

[Bob Clary [:bc] (inactive)]

verified fixed trunk 20060328 win/mac/linux

Comment 13

[Bob Clary [:bc] (inactive)]

fixed by Bug 336373 on the 1.8.1 branch. 
verified fixed 1.8.1 with windows/macppc/linux 20060707