487684 - "Assertion failure: *pc == JSOP_ENTERBLOCK || *pc == JSOP_TRAP" with tracing(true) and exception

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

try {
  tracing(true);
  x;
} catch(e) {
}

Assertion failure: *pc == JSOP_ENTERBLOCK || *pc == JSOP_TRAP, at ../jsopcode.cpp:232

I heard the JS shell's "tracing()" feature might be useful for testing DVG hard with jsfunfuzz, but this assertion is in the way of doing that kind of testing.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

We can't pass in regs.pc and the previous opcode in case we actually need to use the PC.

Comment 2

[Igor Bukanov]

Comment on attachment 371934 [details] [diff] [review]
Proposed fix

>+    if (cx->tracePrevPc && regs->pc >= fp->script->main) {
>+        JSOp tracePrevOp = JSOp(*cx->tracePrevPc);

This may dereference GC-ed script and does not check for JSOP_TRAP.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

(In reply to comment #2)
> This may dereference GC-ed script and

This is easy to fix.

> does not check for JSOP_TRAP.

This is more work than I want to do. We get this wrong currently anyway, so I'd like to hold off on fixing it.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: patch v2

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/b5f70fee3fa1

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/b5f70fee3fa1

Comment 7

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/ff2552207e39