566556 - "Assertion failure: bytes != 0" with defineSetter, watch

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

this.__defineSetter__('x', Object.create);
this.watch('x', function() {});
x = 3;

Assertion failure: bytes != 0, at ../jscntxt.h:1941

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   41905:a00078178698
user:        Luke Wagner
date:        Wed Mar 03 17:52:26 2010 -0800
summary:     Bug 540706 - use contiguous buffer for stack frames and slots (r=waldo)

Comment 2

[Luke Wagner [:luke]]

Attachment: fix

Oh, decompiler.  js_watch_set places a frame for an empty function, with nslots == 0, which, before this patch, (regs.sp == NULL) was catching.  To have fewer corner cases, the contiguous stack patch always keeps regs.sp != NULL (regs.sp == fp->slots() for empty scripts and slow natives), hence the 0-byte malloc.

Comment 3

[Luke Wagner [:luke]]

Oops, pretend I added the test case in comment 0.
Thanks Jesse and Gary!

Comment 4

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/f0f0dfd6a262

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/f0f0dfd6a262

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug566556.js.