552196 - TM: "Assertion failure: size_t(p - cx->fp->slots) < cx->fp->script->nslots, at ../jstracer.cpp" or "Assertion failure: size_t(p - cx->fp->slots()) < cx->fp->script->nslots, at ../jstracer.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(Function("\
  for (a = 0; a < 5; a++)\
  (function f(b) {\
    if (b > 0) {\
      f(b - 1)\
    }\
  })\
  (3)\
"))()

asserts js debug shell with -j on TM tip at Assertion failure: size_t(p - cx->fp->slots) < cx->fp->script->nslots, at ../jstracer.cpp:2545

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 551705:

The first bad revision is:
changeset:   38596:1f812d89de66
user:        David Anderson
date:        Fri Mar 12 11:47:44 2010 -0800
summary:     Fixed regression with recursion and type unstable frame slurping (bug 551705, r=gal).

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Also asserts at:

Assertion failure: size_t(p - cx->fp->slots()) < cx->fp->script->nslots, at ../jstracer.cpp:2546

on JM tip.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Bleh. Backing out this part of the code in bug 551705 was not entirely correct. If branching directly off a JSOP_STOP, there's no stackval(-1) to read. Fortunately it is valid (and necessary) to read regs.pc iff not anchoring off a "slurp fail exit", to see where to get the return value from.

This patch contains a free prize at the bottom: a big comment explaining what slurpDownFrames is.

Comment 4

[Jason Orendorff [:jorendorff]]

Pushed to tracemonkey at Gary's request. Hope this is ok!

http://hg.mozilla.org/tracemonkey/rev/9a0a4c64da0a

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Thanks Jason and everyone. This was kind-of hurting TM fuzzing for awhile.

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/9a0a4c64da0a

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug552196.js.