568867 - Crash [@ js_Interpret] or "Assertion failure: !JSVAL_IS_PRIMITIVE(regs.sp[-1]),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = Proxy.create(function() {
    return {
        get: Object.getPrototypeOf
    }
} (), function() {})
for (z in Proxy.create(x)) {}

crashes js debug shell on TM tip without -j at js_Interpret and asserts js debug shell on TM tip without -j at Assertion failure: !JSVAL_IS_PRIMITIVE(regs.sp[-1]), at ../jsops.cpp:461

Seems to be a near null crash but setting s-s just-in-case. Assuming [sg:dos].

===

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000014
0x0005cc4b in js_Interpret ()
(gdb) bt
#0  0x0005cc4b in js_Interpret ()
#1  0x000665a0 in js_Execute ()
#2  0x0000f67c in JS_ExecuteScript ()
#3  0x00004cfc in Process ()
#4  0x000090ba in main ()
(gdb) x/i $eip
0x5cc4b <js_Interpret+26459>:   mov    0x4(%edx),%eax
(gdb) x/b $edx
0x10:   Cannot access memory at address 0x10

Comment 1

[Brendan Eich [:brendan]]

I don't see iterate: here at all, but anyway, any iterate trap that returns a primitive value should provoke a type error. JS1.7+ precedent:

js> var o = {__iterator__: function () 42};
js> for (i in o);
typein:2: TypeError: o.__iterator__ returned a primitive value

/be

Comment 2

[Andreas Gal :gal]

Very recent problem. Will be fixed before it hits trunk.

Comment 3

[Andreas Gal :gal]

This is what the error message looks like now:

host-5-104:src gal$ ./Darwin_DBG.OBJ/js x.js
x.js:6: TypeError: value is not a non-null object
host-5-104:src gal$ 

I didn't want to use our __iterator__ specific error messages. We might want to add a proxy specific error message tag though. Its hard to debug code in a hall of mirrors. Interesting research problem. We should see how this feels like in real world code.

Brendan, look at the end of the test case. for (i in Proxy.create(x)). That's where iterate() is triggered.

Comment 4

[Andreas Gal :gal]

Attachment: patch

Comment 5

[Brendan Eich [:brendan]]

Comment on attachment 448056 [details] [diff] [review]
patch

Ok as short-term fix -- we need to get that bug for generalizing the JSV2F_ITERATOR thing on file and patched.

/be

Comment 6

[Andreas Gal :gal]

http://hg.mozilla.org/tracemonkey/rev/36d81cc1a7de

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/36d81cc1a7de