454981 - TM: assertion of "size_t(p - cx->fp->slots) < cx->fp->script->nslots"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Makoto Kato [:m_kato]]

Attachment: patch v1

On x86-64, the following script causes assertion.

js> function test() { function f0() { return arguments[0]; } for (var i = 0; i < 4; i++) f0('a'); } test();

Global shape mismatch (124 vs. 0) in RecordTree, flushing cache.
Flushing cache.
recording starting from typein:1@14
    trace

import vp=0x82e870 name=$callee0 type=object flags=0
import vp=0x82e878 name=$this0 type=object flags=0
import vp=0x82e960 name=$test.f0 type=object flags=0
import vp=0x82e968 name=$test.i type=int flags=0
    state = param rdi
    param1 = param rsi
    sp = ldq state[0]
    rp = ldq state[8]
    cx = ldq state[24]
    gp = ldq state[16]
    eos = ldq state[32]
    eor = ldq state[40]
    $callee0 = ldq sp[-32]
    $this0 = ldq sp[-24]
    $test.f0 = ldq sp[-16]
    ld1 = ld sp[-8]
    $test.i = i2f ld1
    sp[0] = $test.f0
    sp[8] = 0
    sp[16] = ATOM_TO_STRING(atom)
    guard(shapeless callee) = eq $test.f0, JSVAL_TO_OBJECT(callee)
    xf1: xf guard(shapeless callee) -> 0x82e784 sp+24 rp+0

EnterFrame f0, callDepth=1
Assertion failure: size_t(p - cx->fp->slots) < cx->fp->script->nslots, at jstracer.cpp:936
Aborted

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 338292 [details] [diff] [review]
patch v1

This is definitely a valid bug.  We don't want to abort the trace though, we're supposed to be filling missing parameters with JSVAL_VOID (which works on x86).

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: patch v2

It looks like (fp->fun->nargs - fp->argc) wasn't being sign-extended, so the pointer math became (ptr + 0x00000000FFFFFFFF).  Maybe the math being in a parenthetical expression caused this.

Attached a new patch.

Comment 3

[Makoto Kato [:m_kato]]

Comment on attachment 338697 [details] [diff] [review]
patch v2

Thanks, it works fine.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix to tracemonkey branch as revision http://hg.mozilla.org/tracemonkey/rev/93cc00a53bd8

Comment 5

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-454981.js,v  <--  regress-454981.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/b7070ea346fc

Comment 6

[Bob Clary [:bc] (inactive)]

note to self: js1_8_1/trace/trace-test.js also exhibits this assertion on m-c.