488034 - Crash [@ js_GetUpvar] or "Assertion failure: (script)->upvarsOffset != 0, at ../jsinterp.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function(){
  var x;
  eval("var x; ((function ()x)())");
})()

asserts TM tip js shell debug without -j:

Assertion failure: (script)->upvarsOffset != 0, at ../jsinterp.cpp:5734

and crashes TM tip js shell opt without -j at js_GetUpvar near null.

autoBisect shows this is probably related to bug 452498:

The first bad revision is:
changeset:   26784:2cf0bbe3772a
user:        Brendan Eich
date:        Sun Apr 05 21:17:22 2009 -0700
summary:     upvar2, aka the big one take 2 (452598, r=mrbkap).

Also possibly related to bug 488015 ?

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Factor out the make-upvar-for-eval code in BindNameToSlot, use it from the place where we see a use in a function nested in eval code that references an upvar we lazily made just for eval called from a function.

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: better fix

The last patch would fix the attached test, but deoptimize this variation:

(function(){
  var x = 42;
  eval("print((function ()x)()); var x");
})()

merely because the var x comes after the lambda whose body uses x. It was easy to fix this given the refactoring done to handle the eval-nested function use case.

/be

Comment 3

[Brendan Eich [:brendan]]

Fixed in tm:

http://hg.mozilla.org/tracemonkey/rev/70111870bcf8

/be

Comment 4

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/70111870bcf8

Comment 5

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/2f83aa29331b

Comment 6

[Henrik Skupin (:whimboo) [⌚️UTC+1]]

Verified fixed with testcase given in comment 0 on trunk and 1.9.1 with the
following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090422 Minefield/3.6a1pre ID:20090422224452

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre)
Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929