522624 - TM: "Assertion failure: *pc == JSOP_GETARG" with recursive getter

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

function r([]) { r(); }
var a = {};
a.__defineGetter__("t", r);
try { a.t; } catch(e) { }
print(uneval(a));

Assertion failure: *pc == JSOP_GETARG, at ../jsopcode.cpp:5007

Only happens with -j.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I'm making a guess that this is due to tracerecursion, as shown by the following autoBisect's regression window:

http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=89e665eb9944&tochange=d04601f54db5

Note that the assertion had morphed from Assertion failure: unsigned(slots) == NativeStackSlots(cx, 1) - fp->argc - 2 - fp->script->nfixed - 1, at ../jsrecursion.cpp:506

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 408083 [details] [diff] [review]
fix

>diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
>--- a/js/src/jsopcode.cpp
>+++ b/js/src/jsopcode.cpp
>@@ -4976,17 +4976,18 @@ js_DecompileFunction(JSPrinter *jp)
> 
>         /* Print the parameters. */
>         pc = fun->u.i.script->main;
>         endpc = pc + fun->u.i.script->length;
>         ok = JS_TRUE;
> 
> #if JS_HAS_DESTRUCTURING
>         /* Skip trace hint if it appears here. */
>-        if (js_GetOpcode(jp->sprinter.context, fun->u.i.script, pc) == JSOP_TRACE) {
>+        if (js_GetOpcode(jp->sprinter.context, fun->u.i.script, pc) == JSOP_TRACE ||
>+            js_GetOpcode(jp->sprinter.context, fun->u.i.script, pc) == JSOP_NOP) {

Use a JSOp op = js_GetOpcode(...) instead of calling twice. r=me with that.

/be

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/5ab2276549b1

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/5ab2276549b1

Comment 6

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929