"Assertion failure: (uintN)top == pcdepth" with regexp iterator, "let"

VERIFIED FIXED in mozilla1.8.1

Status

()

defect
--
critical
VERIFIED FIXED
13 years ago
12 years ago

People

(Reporter: jruderman, Assigned: brendan)

Tracking

(Blocks 1 bug, {crash, testcase, verified1.8.1})

Trunk
mozilla1.8.1
PowerPC
macOS
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.8.1 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

js> obj = {a: 5}; obj.__iterator__ = /x/g; for(x in y = let (z) obj) { }

Debug - Assertion failure: (uintN)top == pcdepth, at jsopcode.c:3614

Opt - recurses to death:

...
486   js_DecompileValueGenerator + 1464
487   GetOff + 128
488   PopOff + 64
489   Decompile + 456
490   js_DecompileCode + 448
491   js_DecompileValueGenerator + 1464
...
Posted patch fixSplinter Review
Have to be more conservative in trying to fix up generating pcs below current model stack depth.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #239309 - Flags: review?(mrbkap)
Comment on attachment 239309 [details] [diff] [review]
fix

Will this leave ss.offsets[0..pcdepth] uninitialized when code (like GetLocal) expects there to be useful data there?
Comment on attachment 239309 [details] [diff] [review]
fix

>Index: jsopcode.c
>===================================================================
>RCS file: /cvsroot/mozilla/js/src/jsopcode.c,v
>retrieving revision 3.184
>diff -p -u -8 -r3.184 jsopcode.c
>--- jsopcode.c	18 Sep 2006 11:04:30 -0000	3.184
>+++ jsopcode.c	20 Sep 2006 05:26:05 -0000
>@@ -3605,18 +3605,17 @@ js_DecompileCode(JSPrinter *jp, JSScript
> 
>         for (fp = cx->fp; fp && !fp->script; fp = fp->down)
>             continue;
>         top = fp ? fp->sp - fp->spbase : 0;
>         for (i = 0; i < pcdepth; i++) {
>             ss.offsets[i] = -1;
>             ss.opcodes[i] = JSOP_NOP;
>         }

This loop unconditionally initializes ss.offsets and ss.opcodes.

>-        if (fp && fp->pc == pc) {
>-            JS_ASSERT((uintN)top == pcdepth);
>+        if (fp && fp->pc == pc && (uintN)top == pcdepth) {

This condition is being made more conservative, but it does not alter the initialization logic.

/be
Comment on attachment 239309 [details] [diff] [review]
fix

I must be vertically dyslexic. I could have sworn those two blocks were reversed.
Attachment #239309 - Flags: review?(mrbkap) → review+
Fixed on trunk.

/be
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Attachment #239309 - Flags: approval1.8.1?
Checking in regress-353454.js;
/cvsroot/mozilla/js/tests/js1_7/iterable/regress-353454.js,v  <--  regress-353454.js
initial revision: 1.1
done
Flags: in-testsuite+
Flags: blocking1.8.1+
Whiteboard: [rc ridealong]
verified fixed 1.9 20060921 windows/mac*/linux
Status: RESOLVED → VERIFIED
Comment on attachment 239309 [details] [diff] [review]
fix

Approved for RC2.
Attachment #239309 - Flags: approval1.8.1? → approval1.8.1+
Whiteboard: [rc ridealong] → [rc ridealong][checkin needed (1.8 branch)]
Target Milestone: --- → mozilla1.8.1
Whiteboard: [rc ridealong][checkin needed (1.8 branch)] → [checkin needed (1.8 branch)]
Fixed on the 1.8 branch:

Checking in jsopcode.c;
/cvsroot/mozilla/js/src/jsopcode.c,v  <--  jsopcode.c
new revision: 3.89.2.61; previous revision: 3.89.2.60
done

/be
Keywords: fixed1.8.1
Whiteboard: [checkin needed (1.8 branch)]
verified fixed 1.8 20060926 windows/mac*/linux
No longer blocks: 349611
Blocks: 349611
You need to log in before you can comment on or make changes to this bug.