583158 - JM: Crash [@ js::mjit::ic::GetGlobalName] or "Assertion failure: index < atomMap.length,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function g() {
  var rv = (function() {
    this << 1
  })()
  if (a) function() {}
}
g()

asserts js debug shell on JM changeset 89964b93d40d with -m at Assertion failure: index < atomMap.length, at ../../jsscript.h:292 and crashes js opt shell with -m at js::mjit::ic::GetGlobalName.

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x001c6bc4 in js::mjit::ic::GetGlobalName ()
(gdb) bt
#0  0x001c6bc4 in js::mjit::ic::GetGlobalName ()
#1  0x002c63c5 in ?? ()
#2  0x0018a0b7 in js::mjit::JaegerShot ()
#3  0x0006ebac in js::Execute ()
#4  0x000151c8 in JS_ExecuteScript ()
#5  0x0000611c in Process ()
#6  0x000099f7 in shell ()
#7  0x00009f28 in main ()
(gdb) x/i $eip
0x1c6bc4 <_ZN2js4mjit2ic13GetGlobalNameERNS_7VMFrameEj+68>:     mov    (%edx,%eax,4),%ecx
(gdb) x/b $edx
0x0:    Cannot access memory at address 0x0
(gdb) x/b $eax
0x0:    Cannot access memory at address 0x0

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

regression from bug 578517

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/129f5aa7099b

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug583158.js.