549602 - JM: Crash [@ js_CompareStrings] or "Assertion failure: JSVAL_IS_STRING(v), at ../jsapi.h"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

version(180)
function f1(code) {
    var c
    var t = code.replace(/s/, "")
    var f = new Function(code)
    var o
    e = v = f2(f, c)
}
function f2(f, e) {
    try {
        a = f()
    } catch(r) {
        var r = g()
    }
}
g1 = [{
    text: "(function sum_slicing(array){return array==0?0:a+sum_slicing(array.slice(1))})",
    test: function (f) {
        f([, 2]) == ""
    }
}];
(function () {
    for (var i = 0; i < g1.length; ++i) {
        var a = g1[i]
        var text = a.text
        var f = eval(text.replace(/@/, ""))
        if (a.test(f)) {}
    }
}())
f1("for(let a=0;a<6;a++){print([\"\"].some(function(){false>\"\"}))}")


crashes js opt shell with -m at js_CompareStrings and asserts js debug shell with -m at Assertion failure: JSVAL_IS_STRING(v), at ../jsapi.h:197

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Doesn't crash for me at jm-tip (829334c3a9ef) - can you check?

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Definitely crashes at changeset 51898db0bbc9 but WFM on 829334c3a9ef too.

Please add the test, then resolve... maybe WORKSFORME?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

changeset:   38715:58da9dcf5c7c
user:        David Mandelin <[e-mail]>
date:        Tue Mar 02 11:51:13 2010 -0800
summary:     [JAEGER] jsop_initmethod and fix typo in relational ops for strings

Probably fixed by this checkin.

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug549602.js.