455969 - TM: "Assertion failure: v_ins->isCall() && v_ins->fid() == F_FastNewArray"

Status: RESOLVED DUPLICATE of bug 457336

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Assertion failure: v_ins->isCall() && v_ins->fid() == F_FastNewArray, at jstracer.cpp:5414

0   JS_Assert + 63
1   TraceRecorder::record_JSOP_ENDINIT() + 261
2   js_Interpret + 175622
3   js_Execute + 813
4   JS_ExecuteScript + 54
5   Process(JSContext*, JSObject*, char*, int) + 578
6   ProcessArgs(JSContext*, JSObject*, char**, int) + 2158
7   main + 636
8   start + 54

I don't have a testcase, but Andreas thinks Brendan might be able to figure out the bug without one.

Comment 1

[Jesse Ruderman]

Attachment: stack trace with locals

I ran jsfunfuzz overnight with "ulimit -c unlimited" so I'd get a core dump for each crash.  It hit this assertion once before running out of disk space ;)  I was then able to run "gdb ./js core.836" to get the state of the crashing process into the debugger.

The core file is 210MB, so I'll keep it around for a few days.

Comment 2

[Brendan Eich [:brendan]]

Jesse, can you poke at the core for me on IRC?

/be

Comment 3

[Brendan Eich [:brendan]]

This is a bug in the layering of TraceRecorder::record_JSOP_INITELEM on top of TraceRecorder::record_JSOP_SETPROP.

/be

Comment 4

[Brendan Eich [:brendan]]

The jsfunfuzz.js line at which the assertion botches is

function(dr) { return cat([makeId(dr)]); }

/be

Comment 5

[Brendan Eich [:brendan]]

Argh. This bit a js test -- shoulda fixed already.

/be