511837 - TM: Crash [@ nanojit::Assembler::freeRsrcOf] or "Assertion failed: p->isQuad() (../nanojit/Nativei386.cpp:1325)" or "Assertion failure: s0->isQuad(), at ../jstracer.cpp" or "Assertion failure: m != TT_INT32 || isInt32(*vp), at ../jstracer.cpp" with Math

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for each(l in ['', 0, 0, ]) {
    print(Math.round(false))
}

asserts js debug shell with -j at Assertion failure: s0->isQuad(), at ../jstracer.cpp:1337

autoBisect shows this is probably related to bug 511307:

The first bad revision is:
changeset:   31632:ccf91ba2d62a
user:        Andreas Gal
date:        Wed Aug 19 15:31:10 2009 -0700
summary:     Specialize math functions to integer arithmetic where appropriate (511307, r=dvander).

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (x = 0; x < 3; ++x) {
  a = Math.floor('')
}

crashes js opt shell with -j at nanojit::Assembler::freeRsrcOf at null and asserts js debug shell with -j at Assertion failed: p->isQuad() (../nanojit/Nativei386.cpp:1325)

autoBisect also points fingers at bug 511307.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

options().n;
(function () {
    Math
})()
for (let x in [0, 0]) {
    ''.replace((Math.min(3, /x/)))
}

asserts js debug shell with -j at Assertion failure: m != TT_INT32 || isInt32(*vp), at ../jstracer.cpp:3206, autoBisect fingering out bug 511307 too.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #1)
> for (x = 0; x < 3; ++x) {
>   a = Math.floor('')
> }
> 
> crashes js opt shell with -j at nanojit::Assembler::freeRsrcOf at null and
> asserts js debug shell with -j at Assertion failed: p->isQuad()
> (../nanojit/Nativei386.cpp:1325)
> 
> autoBisect also points fingers at bug 511307.

Now this morphed to asserting only at Assertion failure: s0->isQuad(), at ../jstracer.cpp:1337. That said, I still see nanojit::Assembler::freeRsrcOf js opt null deref crashes, I'll need to wait for a reduced testcase first.

Comment 4

[Andreas Gal :gal]

Confirmed on TM tip. Good test case.

Comment 5

[Andreas Gal :gal]

Attachment: patch

Comment 6

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/d4faaf65fefb

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/d4faaf65fefb

Comment 8

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/4e6fc06723d9

Comment 9

[Bob Clary [:bc] (inactive)]

js/src/trace-test/tests/basic/testIntFloor.js

Comment 10

[Bob Clary [:bc] (inactive)]

v 1.9.3, 1.9.2