TM: "Assertion failure: obj->getPrivate() == fp, at ../jstracer.cpp" or "Assertion failure: obj->getPrivate() == js_FloatingFrameIfGenerator(cx, fp), at ../jstracer.cpp"

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
8 years ago
5 years ago

People

(Reporter: gkw, Assigned: mrbkap)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 beta2+, blocking1.9.2 -, status1.9.2 wanted, blocking1.9.1 -, status1.9.1 wanted)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

8 years ago
for (let y in eval("\
    for (z = 0; z < 6; z++) {\
        a = z\
    }\
"))(y)

asserts js debug shell on TM tip with -j at Assertion failure: obj->getPrivate() == fp, at ../jstracer.cpp:13732

Found via the compareJIT part of jsfunfuzz.
(Reporter)

Comment 1

8 years ago
autoBisect shows this is probably related to bug 469237:

The first bad revision is:
changeset:   27482:ca40d9bb0954
user:        jimb
date:        Tue Apr 21 22:42:43 2009 -0700
summary:     Bug 469237: Only trace where BINDNAME will choose the global object.
Blocks: 469237
(Reporter)

Comment 2

8 years ago
This affects 1.9.1, 1.9.2 and TM tip js shells. Nominating to get it on the radar.
blocking1.9.1: --- → ?
blocking1.9.2: --- → ?
blocking2.0: --- → ?
Assignee: general → jorendorff
Wanted, not blocking if it's only in a debug shell.
blocking1.9.1: ? → -
blocking1.9.2: ? → -
status1.9.1: --- → wanted
status1.9.2: --- → wanted
(Assignee)

Comment 4

8 years ago
Created attachment 444198 [details] [diff] [review]
Proposed fix

As far as I can tell, this is a bug in the assertion: it assumes that there can only be one frame for a toplevel script. But eval and debugger frames defeat this assumption. The values are still on the stack, so this just widens the assertion.
Assignee: jorendorff → mrbkap
Status: NEW → ASSIGNED
Attachment #444198 - Flags: review?(jorendorff)
Comment on attachment 444198 [details] [diff] [review]
Proposed fix

That needs to be a while loop instead of an if, because...

{
    let y;
    eval('eval("for (z = 0; z < 6; z++) a = z;")');
}

And this needs tests. r+ with those changes.
Attachment #444198 - Flags: review?(jorendorff) → review+
(Reporter)

Comment 6

8 years ago
This has now morphed into the following assertion:

Assertion failure: obj->getPrivate() == js_FloatingFrameIfGenerator(cx, fp), at ../jstracer.cpp:13885
Summary: TM: "Assertion failure: obj->getPrivate() == fp, at ../jstracer.cpp" → TM: "Assertion failure: obj->getPrivate() == fp, at ../jstracer.cpp" or "Assertion failure: obj->getPrivate() == js_FloatingFrameIfGenerator(cx, fp), at ../jstracer.cpp"

Updated

8 years ago
blocking2.0: ? → beta1+
Doesn't block beta 1.
blocking2.0: beta1+ → beta2+
(Assignee)

Comment 8

8 years ago
http://hg.mozilla.org/tracemonkey/rev/769cce825017
Whiteboard: fixed-in-tracemonkey
(Assignee)

Comment 9

8 years ago
http://hg.mozilla.org/tracemonkey/rev/74e8869eb66a
Flags: in-testsuite+

Comment 10

8 years ago
http://hg.mozilla.org/mozilla-central/rev/769cce825017
Status: ASSIGNED → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
(Reporter)

Comment 11

5 years ago
A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.