470618 - TM: "Assertion failure: regs.sp - StackBase(fp) >= 2, at ../jsinterp.cpp"

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (var z = 0; z < 2; ++z) { with({window: (-this)})true; }

asserts dbg at Assertion failure: regs.sp - StackBase(fp) >= 2, at ../jsinterp.cpp:6073 and crashes opt at js_Interpret near null. TM-only.

===

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000088
Crashed Thread:  0

Thread 0 Crashed:
0   js-opt-tm-intelmac            	0x00031d37 js_Interpret + 12247
1   js-opt-tm-intelmac            	0x0003b94f js_Execute + 559
2   js-opt-tm-intelmac            	0x0000959e JS_ExecuteScript + 60
3   js-opt-tm-intelmac            	0x00002dd0 Process(JSContext*, JSObject*, char*, int) + 1032
4   js-opt-tm-intelmac            	0x00006938 main + 2310
5   js-opt-tm-intelmac            	0x0000221b _start + 209
6   js-opt-tm-intelmac            	0x00002149 start + 41

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

See bug 470619 for a similar assertion.

Comment 2

[Andreas Gal :gal]

Any way to trigger this in the shell?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #2)
> Any way to trigger this in the shell?

Just run |./js -j| then input:

for (var z = 0; z < 2; ++z) { with({window: (-this)})true; }

at the js> command prompt then press enter?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

WFM on TM tip.