575208 - Crash [@ js::ExecuteFrameGuard::~ExecuteFrameGuard] or "Assertion failure: origin != destination,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

with(evalcx('')) for each(z in [new Boolean(true)]) {}

asserts js debug shell without -j on TM tip at Assertion failure: origin != destination, at ../jswrapper.cpp:422 and crashes js opt shell without -j on TM tip at js::ExecuteFrameGuard::~ExecuteFrameGuard

Seems to be a null crash:

(gdb) bt
#0  0x00022b26 in js::ExecuteFrameGuard::~ExecuteFrameGuard ()
#1  0x001018ee in js::AutoCompartment::leave ()
#2  0x0000e4b2 in JS_LeaveCrossCompartmentCall ()
#3  0x00007b6f in shell ()
#4  0x000085a7 in main ()
(gdb) x/i $eip
0x22b26 <_ZN2js17ExecuteFrameGuardD1Ev+22>:     movl   $0x0,(%eax)

Comment 1

[Brendan Eich [:brendan]]

Gary, if you see "Compartment", cc: the compartment team.

/be

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #1)
> Gary, if you see "Compartment", cc: the compartment team.

OK.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   44269:3aaaa21012c8
user:        Jason Orendorff
date:        Wed Jun 23 16:35:10 2010 -0500
summary:     Bug 563099 - Compartments and wrappers API. r=gal.

Comment 3

[Jason Orendorff [:jorendorff]]

Same crash:

  new (evalcx('Boolean'));

JSProxyHandler::construct seems to be the culprit. Patch coming later today.

Comment 4

[Jason Orendorff [:jorendorff]]

Attachment: v1

Is it safe to assume that GetCall isn't going to return JSVAL_VOID here?

Comment 5

[Jason Orendorff [:jorendorff]]

Attachment: v2

Sorry, v1 was incomplete.

Doubt about GetCall afflicts me still.

Comment 6

[Andreas Gal :gal]

Comment on attachment 455749 [details] [diff] [review]
v2

Thanks. A fixme with the bug # for primitive this support?

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This was checked in to TM:

http://hg.mozilla.org/tracemonkey/rev/196f9c7d868f

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/196f9c7d868f