520511 - Crash [@ js_PutBlockObject] or [@ 0x1aecdd50] or "Assertion failure: JSVAL_IS_OBJECT(v), at ../jsapi.h"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (b = 0; b < 1; b++) {
    this.watch("x", eval)
}
__defineGetter__("x", gc);
var f = (function () {
    __defineSetter__("x", function () {})
});
for (i = 0; i < 1; i++) {}
f();
for (let a = 0; a < 1; a++) x = 1


crashes js opt shell on TM tip at js_PutBlockObject near null and asserts dbg shell at Assertion failure: JSVAL_IS_OBJECT(v), at ../jsapi.h:183

autoBisecting soon...


Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x000000000000001c
Crashed Thread:  0

Thread 0 Crashed:
0   js-opt-tm-darwin              	0x00068cb3 js_PutBlockObject + 35
1   js-opt-tm-darwin              	0x00057250 js_Interpret + 37040
2   js-opt-tm-darwin              	0x0005df1a js_Execute + 362
3   js-opt-tm-darwin              	0x0000d52c JS_ExecuteScript + 60
4   js-opt-tm-darwin              	0x000040b8 __ZL7ProcessP9JSContextP8JSObjectPci + 1336
5   js-opt-tm-darwin              	0x00008174 main + 2212
6   js-opt-tm-darwin              	0x0000204b _start + 209
7   js-opt-tm-darwin              	0x00001f79 start + 41

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I'm currently on http://hg.mozilla.org/tracemonkey/rev/07e524d2a503

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The assert/crash occurs without -j.

autoBisect shows this is probably related to bug 495325:

The first bad revision is:
changeset:   33133:de72243414cd
user:        Blake Kaplan
date:        Mon Aug 17 18:08:20 2009 -0700
summary:     Bug 495325 - Follow ES about indirect eval being global eval. r=brendan/igor

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I have a almost-fully-reduced-testcase that asserts identically but crashes at a scary location.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

This crashes opt js shell without -j:

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x000000001aecdd50
Crashed Thread:  0

Thread 0 Crashed:
0   js-opt-tm-darwin              	0x000c1b42 JSScope::searchTable(long, bool) + 50
1   js-opt-tm-darwin              	0x0006ba14 js_LookupPropertyWithFlags + 164
2   js-opt-tm-darwin              	0x0006d8e1 js_FindIdentifierBase + 161
3   js-opt-tm-darwin              	0x000513da js_Interpret + 11370
4   js-opt-tm-darwin              	0x0005e68c js_Execute + 444
5   js-opt-tm-darwin              	0x0000d57c JS_ExecuteScript + 60
6   js-opt-tm-darwin              	0x000041b5 __ZL7ProcessP9JSContextP8JSObjectPci + 1605
7   js-opt-tm-darwin              	0x000081a4 main + 2212
8   js-opt-tm-darwin              	0x0000203b _start + 209
9   js-opt-tm-darwin              	0x00001f69 start + 41


and also asserts at Assertion failure: JSVAL_IS_OBJECT(v), at ../jsapi.h:183

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/2581d8d91679

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/2581d8d91679