517076 - Crash [@ js_CallIteratorNext] or "Assertion failure: STOBJ_GET_CLASS(obj) != &js_BlockClass, at ../jsscope.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(Function("\
    for (var a = 0; a < 2; a++) {\
        let z;\
        switch (#1=/x/) {}\
    }\
"))()

asserts js dbg shell without -j on TM tip at Assertion failure: STOBJ_GET_CLASS(obj) != &js_BlockClass, at ../jsscope.cpp:103

autoBisect coming up later...

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 514981:

The first bad revision is:
changeset:   32201:c19b0d06d076
user:        Brendan Eich
date:        Wed Sep 09 20:21:15 2009 -0700
summary:     Bug 514981 - JSStackFrame::sharp{Array,Depth} should be locals allocated due to #n[#=] usage (r=igor).

Comment 2

[Damon Sicore (:damons)]

Blocks a non-blocking bug that's not on 1.9.2.  -'ing for blocking 1.9.2.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(Function("for(b in[0,0,0]) let(N=#0=/x/,d) (function(){})"))()

crashes opt builds without -j on TM tip at js_CallIteratorNext near null.

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000004
Crashed Thread:  0

Thread 0 Crashed:
0   js-opt-tm-darwin              	0x0005fda2 js_CallIteratorNext + 18
1   js-opt-tm-darwin              	0x000543eb js_Interpret + 25147
2   js-opt-tm-darwin              	0x0005df2a js_Execute + 362
3   js-opt-tm-darwin              	0x0000d54c JS_ExecuteScript + 60
4   js-opt-tm-darwin              	0x000040d8 __ZL7ProcessP9JSContextP8JSObjectPci + 1336
5   js-opt-tm-darwin              	0x00008194 main + 2212
6   js-opt-tm-darwin              	0x0000206b _start + 209
7   js-opt-tm-darwin              	0x00001f99 start + 41

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #2)
> Blocks a non-blocking bug that's not on 1.9.2.  -'ing for blocking 1.9.2.

Renom blocking1.9.2? because the fingered bug 514981 has been nominated blocking1.9.2?

Comment 6

[Brendan Eich [:brendan]]

Attachment: fix

Gonna commit this r=me ASAP.

/be

Comment 7

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/0a1c844e781a

/be

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/0a1c844e781a