479567 - TM: Crash [@ JS_CallTracer] or "Assertion failure: thing, at ../jsgc.cpp" with gc, eval, watch, toSource

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f()
{
  (eval("(function(){for each (y in [false, false, false]);});"))();
}

this.__defineGetter__("x", gc);
uneval(this.watch("y", this.toSource))
f();
throw x;

asserts at Assertion failure: thing, at ../jsgc.cpp:2631 in dbg js shell with -j, and also causes a null deref in JS_CallTracer in opt js shell with -j.

Nominating blocking1.9.1? because this involves gc.


Verbose output:
/snip
fragment 0x3108a0:
ENTRY: S0 S5 S0 S6 G4 
recording completed at 14a.js:3@12 via closeLoop
Looking for compat peer 3@12, from 0x3108a0 (ip: 0x30e2d8, hits=2)
checking vm types 0x3108a0 (ip: 0x30e2d8): callee0=O/O this0=O/N stack0=O/O stack1=B/B global0=S/S 
entering trace at 14a.js:3@12, native stack slots: 6 code: 0x264f38
global: string<0x2a2c60> 
stack: callee0=object<0x2a5700:Function> this0=stack0=object<0x2a01e0:Iterator> stack1=boolean<0> 
leaving trace at 14a.js:3@16, op=ifne, lr=0x2632b8, exitType=3, sp=3, calldepth=0, cycles=61358
string<0x0> 
callee0=object<0x2a5700:Function> this0=null<0x0> stack0=object<0x2a01e0:Iterator> stack1=boolean<3> stack2=boolean<0> 
Assertion failure: thing, at ../jsgc.cpp:2631
Trace/BPT trap

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A similar [sg:investigate] bug that was recently fixed is bug 473282.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

WFM with TM tip.

How should this be resolved, since it's a blocking1.9.1+ ? (I don't know what fixed this.)

Comment 3

[Bob Clary [:bc] (inactive)]

Attachment: js1_6/extensions/regress-479567.js

fixed by bug 479109
http://hg.mozilla.org/tracemonkey/rev/094c2e9de304

Comment 4

[Bob Clary [:bc] (inactive)]

verified 1.9.1, 1.9.2

Comment 5

[Bob Clary [:bc] (inactive)]

test checked into 1.9.0, 1.9.1, 1.9.2, tracemonkey. 1.9.3 will get picked up in the next merge.