560098 - TM: "Assertion failure: invalid RECURSIVE_MISMATCH exit, at ../jsrecursion.cpp" or "Assertion failure: uint32(unboxed) <= 1, at ../jsbuiltins.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Function("\
    for each(let w in [(5), false, Number, false]) {\
        (function f(zzzzzz) {\
            return zzzzzz.length == 0 ? 0 : zzzzzz[0] + f(zzzzzz.slice(1))\
        })([, [], [], w, , ])\
    }\
")()

asserts js debug shell on TM tip with -j at Assertion failure: invalid RECURSIVE_MISMATCH exit, at ../jsrecursion.cpp:142 while a variant:

Function("\
    for each(let w in [(void 0), (void 0), false, false, false, false, false, \
                       undefined, undefined, false, (void 0), undefined]) {\
        (function f(zzzzzz) {\
            return zzzzzz.length == 0 ? 0 : zzzzzz[0] + f(zzzzzz.slice(1))\
        })([w, , w, w, [], []])\
    }\
")()

asserts js debug shell on TM tip with -j at Assertion failure: uint32(unboxed) <= 1, at ../jsbuiltins.cpp:323

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows that this is probably related to bug 552586:

The first bad revision is:
changeset:   39512:3f09b480b148
user:        Luke Wagner
date:        Thu Mar 18 12:12:06 2010 -0700
summary:     Bug 552586 - split JSVAL_SPECIAL into TT_SPECIAL and TT_VOID (r=dvander)

Comment 2

[Luke Wagner [:luke]]

Attachment: patch

Ah, I should have remembered that we do a hole-to-undefined fixup which, before my patch, stayed TT_SPECIAL but now changes from TT_SPECIAL to TT_VOID.  The patch includes a more direct test case for the error.

Also, I think this patch removes the only use of the special (no pun intended) JSVAL_HOLE_FLAG/JSVAL_VOID invariant.  If the basic patch looks good to David, I think I can remove all the related comments and static asserts and number the special values contiguously.

Comment 3

[Luke Wagner [:luke]]

Attachment: with fprintf removed

oops

Comment 4

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/1f9e21e2fd2b

Comment 5

[Luke Wagner [:luke]]

Fix error on 64-bit
http://hg.mozilla.org/tracemonkey/rev/027c8a170ea7

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/1f9e21e2fd2b

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug560098.js.