463259 - "Assertion failure: VALUE_IS_FUNCTION(cx, fval)"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Attachment: stack trace

(function(){
  eval("(function(){ for (var j=0;j<4;++j) if (j==3) undefined(); })();");
})();

Assertion failure: VALUE_IS_FUNCTION(cx, fval), at ../jstracer.cpp:5278

Yay, "branch instability" in jsfunfuzz found a bug!

I think this is a regression from the last day or so.  jsfunfuzz is hitting it a lot.

Comment 1

[Brendan Eich [:brendan]]

Regression from patch for bug 462989.

/be

Comment 2

[Andreas Gal :gal]

WFM with TM tip.

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix

We could check in JSOP_CALLNAME's recorder but this checking matches the interpreter and it is the smallest change. The JSVAL_IS_FUNCTION check being in guardShapelessCallee was an optimization that depended on bug 462989.

/be

Comment 4

[Jesse Ruderman]

Still happens for me with TM tip.

Comment 5

[Brendan Eich [:brendan]]

Attachment: fix

mrbkap pointed out a few things...

/be

Comment 6

[Brendan Eich [:brendan]]

Fixed:

http://hg.mozilla.org/tracemonkey/rev/c251a3dde8f8

/be

Comment 7

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-463259.js,v  <--  regress-463259.js
initial revision: 1.1

Comment 8

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2