Closed Bug 575208 Opened 10 years ago Closed 10 years ago

Crash [@ js::ExecuteFrameGuard::~ExecuteFrameGuard] or "Assertion failure: origin != destination,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: gkw, Assigned: jorendorff)

References

Details

(4 keywords, Whiteboard: [ccbr] fixed-in-tracemonkey)

Crash Data

Attachments

(1 file, 1 obsolete file)

with(evalcx('')) for each(z in [new Boolean(true)]) {}

asserts js debug shell without -j on TM tip at Assertion failure: origin != destination, at ../jswrapper.cpp:422 and crashes js opt shell without -j on TM tip at js::ExecuteFrameGuard::~ExecuteFrameGuard

Seems to be a null crash:

(gdb) bt
#0  0x00022b26 in js::ExecuteFrameGuard::~ExecuteFrameGuard ()
#1  0x001018ee in js::AutoCompartment::leave ()
#2  0x0000e4b2 in JS_LeaveCrossCompartmentCall ()
#3  0x00007b6f in shell ()
#4  0x000085a7 in main ()
(gdb) x/i $eip
0x22b26 <_ZN2js17ExecuteFrameGuardD1Ev+22>:     movl   $0x0,(%eax)
Gary, if you see "Compartment", cc: the compartment team.

/be
(In reply to comment #1)
> Gary, if you see "Compartment", cc: the compartment team.

OK.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   44269:3aaaa21012c8
user:        Jason Orendorff
date:        Wed Jun 23 16:35:10 2010 -0500
summary:     Bug 563099 - Compartments and wrappers API. r=gal.
blocking2.0: --- → ?
Assignee: general → jorendorff
Same crash:

  new (evalcx('Boolean'));

JSProxyHandler::construct seems to be the culprit. Patch coming later today.
Attached patch v1 (obsolete) — Splinter Review
Is it safe to assume that GetCall isn't going to return JSVAL_VOID here?
Attachment #455614 - Flags: review?(gal)
Attached patch v2Splinter Review
Sorry, v1 was incomplete.

Doubt about GetCall afflicts me still.
Attachment #455614 - Attachment is obsolete: true
Attachment #455749 - Flags: review?(gal)
Attachment #455614 - Flags: review?(gal)
Comment on attachment 455749 [details] [diff] [review]
v2

Thanks. A fixme with the bug # for primitive this support?
Attachment #455749 - Flags: review?(gal) → review+
This was checked in to TM:

http://hg.mozilla.org/tracemonkey/rev/196f9c7d868f
Whiteboard: [ccbr] → [ccbr] fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/196f9c7d868f
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
blocking2.0: ? → betaN+
Crash Signature: [@ js::ExecuteFrameGuard::~ExecuteFrameGuard]
You need to log in before you can comment on or make changes to this bug.