520613 - TM: Crash [@ js_ValueToNumber] or "Assertion failure: !JSVAL_IS_PRIMITIVE(v), at ../jsnum.cpp" with recursion

Status: RESOLVED DUPLICATE of bug 520503

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(Function("for (var a = 0; a < 6; a++) {\
        (function sum_indexing(b, c) {\
            return b.length == c ? 0 : b[c] + sum_indexing(b, c + 1)\
        })([(void 0), Infinity, Infinity], 0)\
}"))()

crashes js opt shell on TM tip with -j at js_ValueToNumber at 0x00000580 and asserts js debug shell on TM tip with -j at Assertion failure: !JSVAL_IS_PRIMITIVE(v), at ../jsnum.cpp:995

This smells like it's caused by tracerecursion...


Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000580
Crashed Thread:  0

Thread 0 Crashed:
0   js-opt-tm-darwin              	0x000630fc js_ValueToNumber + 188
1   js-opt-tm-darwin              	0x00058432 js_Interpret + 41618
2   js-opt-tm-darwin              	0x0005df1a js_Execute + 362
3   js-opt-tm-darwin              	0x0000d52c JS_ExecuteScript + 60
4   js-opt-tm-darwin              	0x000040b8 __ZL7ProcessP9JSContextP8JSObjectPci + 1336
5   js-opt-tm-darwin              	0x00008174 main + 2212
6   js-opt-tm-darwin              	0x0000204b _start + 209
7   js-opt-tm-darwin              	0x00001f79 start + 41

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

This is probably bug 520503 but we'll see.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Definitely the same crash, including this test case in patch.

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 520503).