553784 - JM: (64-bit) "Assertion failure: cx->throwing, at ../methodjit/Stubs.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function(){
  (x)=<x>></x>
})()
try{
  (function(){
    ((function a(aaaaaa,bbbbbb){
      if(aaaaaa.length==bbbbbb){
        return eval%bbbbbb.valueOf()
      }
      cccccc=a(aaaaaa,bbbbbb+1)
      return cccccc._=x
    })([,,,,,,,,,,,,,,,,,,0],0))
  })()
}catch(e){}


asserts 64-bit js debug shell on JM tip with -m at Assertion failure: cx->throwing, at ../methodjit/Stubs.cpp:3231

This seems to occur as far back as this changeset:

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/cb99898f20a5

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

OOM and E4X. Nice combination.

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/f054abe132ef

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug553784.js.