550490 - JM: Crash [@ js::jsl_GetUpvar] or "Assertion failure: fp->script, at ../jsinterp.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function a() {
  function f() {}
  this.d = function() {
    f
  }
} (function() {
  var a2, x
  a2 = new a;
  d = (function(){x * 1})();
})()

crashes js opt shell on JM tip with -m at js::jsl_GetUpvar and asserts debug shell on JM tip with -m at Assertion failure: fp->script, at ../jsinterp.cpp:1829

This occurs very frequently and because it occurs in jsfunfuzz code, blocks fuzzing.

Occurs in changeset http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/024479e57d25

but not in changeset http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/4c2029c3e4b8

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #0)
> but not in changeset
> http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/4c2029c3e4b8

Ignore this part of the regression window, I screwed something up. Still seems to occur in http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/3671d1e45072

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/7dcc1ec7eb99

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Explanation: we were running the display update code twice, once in js_Interpret and once in InlineCall().

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug550490.js.