490191 - "Assertion failure: slot < fp->script->nslots, at ../jsinterp.cpp" with defineGetter, eval

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(param) {
  var w;
  return eval("\
    (function(){\
      __defineGetter__(\"y\", function()({\
        x: function(){ return w }()\
      }))\
    });\
  ");
}
(f())();
(new Function("eval(\"y\")"))();


asserts dbg js shell without -j at Assertion failure: slot < fp->script->nslots, at ../jsinterp.cpp:2044

autoBisect shows this is possibly related to bug 488034 :

The first bad revision is:
changeset:   27186:70111870bcf8
user:        Brendan Eich
date:        Mon Apr 13 14:16:15 2009 -0700
summary:     Bug 488034 - Crash [@ js_GetUpvar] or "Assertion failure: (script)->upvarsOffset != 0, at ../jsinterp.cpp" (r=mrbkap).

Comment 1

[Brendan Eich [:brendan]]

Same underlying cause as bug 491806, fixed by that bug's patch. Dup'ing forward, setting in-testsuite? to get this bug's fuzzer-generated test captured under js/tests.

Rob, please make bug 491806 block. Thanks.

Bob, if making bug 491806 block this bug is better please feel free to reopen and set the dependency. I'm happy to be schooled, but at this point it's clear this bug and bug 491806 are due to the same flaw in comprehension expression blockid adjustment, described in bug 491806 comment 1. Thanks for any tips.

/be

Comment 2

[Brendan Eich [:brendan]]

Yikes, comment 1 was meant for bug 490568. Sorry about the mess!

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: spot-fix for now

Ideally we would recognize upvars that cross eval to its function caller in the parser, along with gvars. But that is hard and this is easy, and it looks to be sufficient. Blake, your upvar analysis thinking-cap is required.

/be

Comment 4

[Brendan Eich [:brendan]]

Fixed in tm:

http://hg.mozilla.org/tracemonkey/rev/ef5eab9a08ec

/be

Comment 5

[Brendan Eich [:brendan]]

Fixed in m-c:

http://hg.mozilla.org/mozilla-central/rev/664431e6d306

/be

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

This checkin is in a range suspected to have caused a TXul regression on OSX:

Regression: Txul increase from 312.789 to 326.947 (4.53%) on Sun May 10 16:20:00 2009. Mac105 1.9.2 build 20090510132032
   http://graphs.mozilla.org/#show=794371,794398,794384&sel=1241813896,1242159496
   http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6ea54bfd7c28&tochange=a6068cf686fe

Comment 7

[Boris Zbarsky [:bzbarsky]]

Filed bug 492355 to track that regression.

Comment 8

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/2b96c66d4c19

Comment 9

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Verified fixed with testcase in comment 0 with the following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090522 Minefield/3.6a1pre ID:20090522133810

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre)
Gecko/20090522 Shiretoko/3.5pre ID:20090522153422

Comment 10

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929