483630 - JS parser behaves differently on Mac and Linux

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jim Blandy :jimb]

In changeset 95f3b4659cb2, on Mac we see:

$ ./js-dbg-tm-intelmac -j
js> (function (){ for (var y in this) {} })();
js> [''.watch("", function(){}) for each (x in ['', '', eval, '', '']) if
(x)].map(Function)
Assertion failure: count <= (size_t) (fp->regs->sp - StackBase(fp) - depth), at ../jsobj.cpp:2409
Trace/BPT trap

$ 

while on Linux we see:

frida:src$ obj~/js
js> (function (){ for (var y in this) {} })();
js> [''.watch("", function(){}) for each (x in ['', '', eval, '', '']) if
(x)].map(Function)
typein:3: SyntaxError: malformed formal parameter
js>

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

https://bugzilla.mozilla.org/show_bug.cgi?id=479351#c0 is another example where a hang occurred in Linux but not in Mac.

Comment 2

[Andreas Gal :gal]

Was the JIT off intentionally during the Linux test?

Comment 3

[Jim Blandy :jimb]

No, but the results are the same:

frida:src$ obj~/js -j
js> (function (){ for (var y in this) {} })();
js> [''.watch("", function(){}) for each (x in ['', '', eval, '', '']) if
(x)].map(Function)
typein:3: SyntaxError: malformed formal parameter
js>

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #3)
> No, but the results are the same:
> 
> frida:src$ obj~/js -j
> js> (function (){ for (var y in this) {} })();
> js> [''.watch("", function(){}) for each (x in ['', '', eval, '', '']) if
> (x)].map(Function)
> typein:3: SyntaxError: malformed formal parameter
> js>

Nope, I beg to differ - 32-bit Ubuntu Linux shows the assertion with that changeset with -j on.

$ ./js-dbg-tm-intelmac 
js> (function (){ for (var y in this) {} })();
js> [''.watch("", function(){}) for each (x in ['', '', eval, '', '']) if(x)].map(Function)
typein:2: SyntaxError: malformed formal parameter
js> 
$ ./js-dbg-tm-intelmac -j
js> (function (){ for (var y in this) {} })();
js> [''.watch("", function(){}) for each (x in ['', '', eval, '', '']) if(x)].map(Function)
Assertion failure: count <= (size_t) (fp->regs->sp - StackBase(fp) - depth), at ../jsobj.cpp:2409
Trace/breakpoint trap (core dumped)
$ hg identify
95f3b4659cb2

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I've sent a js shell executable and core dump to Jim, we'll probably cast this aside till blockers for 3.5 are done.

Comment 6

[Jim Blandy :jimb]

I can reproduce now.  Sorry for the fuss:

$ hg identify
95f3b4659cb2
$ grep 'running' obj~/config.status
    echo "running ${CONFIG_SHELL-/bin/sh} ../configure  '--enable-debug=-g3 -O0' --disable-optimize --no-create --no-recursion"
$ obj~/js
js> (function (){ for (var y in this) {} })();
js> [''.watch("", function(){}) for each (x in ['', '', eval, '', ''])
if(x)].map(Function)
typein:3: SyntaxError: malformed formal parameter
js> 
$ obj~/js -j
js> (function (){ for (var y in this) {} })();
js> [''.watch("", function(){}) for each (x in ['', '', eval, '', ''])
if(x)].map(Function)
Assertion failure: count <= (size_t) (fp->regs->sp - StackBase(fp) - depth), at ../jsobj.cpp:2409
Trace/breakpoint trap (core dumped)
$ c++ --version
c++ (GCC) 4.4.0 20090319 (experimental)
Copyright (C) 2009 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ uname -a
Linux frida 2.6.27-14-generic #1 SMP Fri Mar 13 18:00:20 UTC 2009 i686 GNU/Linux
$ cat /etc/issue
Ubuntu 8.10 \n \l

$

Comment 7

[(PTO June 19-July 7) Ryan VanderMeulen]

Jim, can you reproduce with methodjit?

Comment 8

[Luke Wagner [:luke]]

The tracer has been removed.