531513 - TM: "Assertion failure: ((jsval) obj & JSVAL_TAGMASK) == JSVAL_OBJECT, at ../jsapi.h"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
  (eval("\
    (function() {\
      for (var y = 0; y < 4; y++) {\
        w = y\
      }\
    })")
  )()
} catch(e) {}
(function() {
  for (v in (x = {})) {}
})();
(function() {
  for (var z = 0; z < 8; z++) {
    if (z == 5) {
      x /= x
    } else {
      for each(w in [1]) {}
    }
  }
})()


asserts js debug shell on TM tip with -j at Assertion failure: ((jsval) obj & JSVAL_TAGMASK) == JSVAL_OBJECT, at ../jsapi.h:204

autoBisecting soon...

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Forgot to add, 64-bit shell on 10.6.2, haven't tried with 32-bit yet...

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This occurs both in 64-bit and 32-bit js shells in 10.6.2.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows that this is probably related to bug 509093:

The first bad revision is:
changeset:   31583:7a1032f3aac0
user:        David Anderson
date:        Mon Aug 17 18:01:00 2009 -0700
summary:     Improved joinEdgesToEntry functionality and cleanliness (bug 509093, r=sayrer,gal).

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Nominating blocking1.9.2? because possibly-related bug 509093 has landed on 1.9.2 branch.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Ugh. When I did that cleanup, this was the one piece of functionality I changed. Turns out it's not safe as written. What happens:
1. Peer #1 is built, does not have global X. The tail is type-unstable.
2. Peer #2 is built, adds X as TT_OBJECT along the way. The tail is TT_DOUBLE.

If the edge of peer #1 is linked to peer #2, then peer #1 won't necessarily get correctly specialized. It really has to get TT_OBJECT from the entry of the peer #2, rather than the current global state.

Comment 6

[Andreas Gal :gal]

Comment on attachment 415143 [details] [diff] [review]
fix

This looks very similar to the SpecializeTreeToMissingGlobals function. Whats the difference?

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix v2

They are similar, so I've made one version wrap the more general one. This one is for trunk, I'll post a 1.9.2 patch once this gets reviewed.

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/d5c091d56e56

Comment 9

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: 1.9.2 patch

Comment 10

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/d5c091d56e56

Comment 11

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/175c4f7e462d

Comment 12

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929