582480 - TM: Crash [@ js::TraceRecorder::record_JSOP_LAMBDA] or "Assertion failure: isObject(),"

Status: RESOLVED DUPLICATE of bug 582479

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    for (b = 0; b < 2; b++) {
        if (b) {
            ("")(function() {})
        }
    }
})()

crashes js opt shell on TM tip with -j at js::TraceRecorder::record_JSOP_LAMBDA and asserts js debug shell with -j at Assertion failure: isObject(), at ../jsvalue.h:531

===

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x0000008f
0x00171da3 in js::TraceRecorder::record_JSOP_LAMBDA ()
(gdb) bt
#0  0x00171da3 in js::TraceRecorder::record_JSOP_LAMBDA ()
#1  0x00174f8f in js::TraceRecorder::monitorRecording ()
#2  0x0005e98e in js::Interpret ()
#3  0x0006dd1b in js::Execute ()
#4  0x00014178 in JS_ExecuteScript ()
#5  0x0000518c in Process ()
#6  0x00008a97 in shell ()
#7  0x00008fb7 in main ()
(gdb) x/i $eip
0x171da3 <_ZN2js13TraceRecorder18record_JSOP_LAMBDAEv+2819>:    testb  $0x8,0x3b(%eax)
(gdb) x/b $eax
0x54:   Cannot access memory at address 0x54

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   48073:80382d88b92c
user:        Brendan Eich
date:        Fri Jul 23 14:41:56 2010 -0700
summary:     Arguments.callee.caller does not work in FF 4 under certain circumstances (577648, r=jwalden).

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 582479).