510655 - TM: "Assertion failure: argsobj->getPrivate() == fp, at ../jsfun.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function () {
    for (b in [0, 0]) {
        (eval("\
            [this\
                for (b in [\
                    [undefined],\
                    arguments,\
                    [undefined]\
                ])\
            ]\
        "))
    }
})()

asserts js dbg shell with -j on TM branch at Assertion failure: argsobj->getPrivate() == fp, at ../jsfun.cpp:298

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 495061 :

The first bad revision is:
changeset:   31470:8702299aa4dc
user:        Igor Bukanov
date:        Fri Aug 14 20:43:16 2009 +0200
summary:     bug 495061 -  js_PutArgsObject and js_PutCallObject that never fail. r=brendan

Comment 2

[David Mandelin [:dmandelin]]

I'm guessing the assert uncovered a bug in tracing |arguments|.

Comment 3

[David Mandelin [:dmandelin]]

Attachment: Patch

The problem is this:

When leaving a trace, if any synthesized frame has an argsobj, we set argsobj->private() to that frame. (On trace, we can't set the frame, because it doesn't exist. So we do it on exit.) But this is invalid for frames that are created by js_Execute: they can have a copy of fp->down->argsobj, in which case they already have a private pointer, which we shouldn't mess with.

Comment 4

[Igor Bukanov]

Comment on attachment 394912 [details] [diff] [review]
Patch

>diff -r ad2312d97029 js/src/jstracer.cpp
>--- a/js/src/jstracer.cpp	Mon Aug 17 12:05:54 2009 -0700
>+++ b/js/src/jstracer.cpp	Mon Aug 17 14:38:15 2009 -0700
>@@ -2525,8 +2525,12 @@
>         for (; n != 0; fp = fp->down) {
>             --n;
>             if (fp->callee) {
>-                if (fp->argsobj)
>+                // If |fp->argsobj == fp->down->argsobj|, then fp is a frame created
>+                // by js_Execute and the args object does not belong to fp.
>+                if (fp->argsobj && 
>+                    (!fp->down || fp->argsobj != fp->down->argsobj)) {
>                     JS_SetPrivate(cx, JSVAL_TO_OBJECT(fp->argsobj), fp);

Pre-existing nit - use JSVAL_TO_OBJECT(fp->argsobj)->setPrivate(fp); here. I should have done that in bug 493457.

Comment 5

[David Mandelin [:dmandelin]]

Pushed to TM with nit fixed as 19728bf133dd. (Somehow I knew about getPrivate() but not setPrivate(). Well, now I do, anyway. :-) )

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/19728bf133dd

Comment 7

[Damon Sicore (:damons)]

Blocking, P1.  Dmandelin says it's scary, too.

Comment 8

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/971f31e77e34

Comment 9

[Bob Clary [:bc] (inactive)]

js/src/trace-test/tests/basic/bug510655.js

Comment 10

[Bob Clary [:bc] (inactive)]

v 1.9.3, 1.9.2