588339 - "Assertion failure: hasFunction()," with sharps

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(#3={})
eval("#1={}")

asserts TM changeset 27a70c60b48d without -j at Assertion failure: hasFunction(), at ../../jsinterp.h:378 (pass in as a CLI argument)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x00158d3d in JS_Assert (s=0x20e494 "hasFunction()", file=0x20e3b6 "../../jsinterp.h", ln=378) at ../jsutil.cpp:80
80          *((int *) NULL) = 0;  /* To continue from here in GDB: "return" then "continue". */
(gdb) bt
#0  0x00158d3d in JS_Assert (s=0x20e494 "hasFunction()", file=0x20e3b6 "../../jsinterp.h", ln=378) at ../jsutil.cpp:80
#1  0x0000eab7 in JSStackFrame::getFunction (this=0x10000a0) at jsinterp.h:378
#2  0x000ba259 in js::Execute (cx=0x809400, chain=0x702000, script=0x50c7d0, down=0x10000a0, flags=16, result=0x1000100) at jsinterp.cpp:808
#3  0x000db0f2 in obj_eval (cx=0x809400, argc=1, vp=0x1000100) at ../jsobj.cpp:1231
#4  0x000a71aa in js::Interpret (cx=0x809400) at ../jsinterp.cpp:4706
#5  0x000ba6e5 in js::Execute (cx=0x809400, chain=0x702000, script=0x50c1c0, down=0x0, flags=0, result=0x0) at jsinterp.cpp:891
#6  0x0001666b in JS_ExecuteScript (cx=0x809400, obj=0x702000, script=0x50c1c0, rval=0x0) at ../jsapi.cpp:4754
#7  0x0000bb59 in Process (cx=0x809400, obj=0x702000, filename=0xbffff954 "hasFunct.js", forceTTY=0) at ../../shell/js.cpp:440
#8  0x0000c89d in ProcessArgs (cx=0x809400, obj=0x702000, argv=0xbffff83c, argc=1) at ../../shell/js.cpp:854
#9  0x0000c9b6 in shell (cx=0x809400, argc=1, argv=0xbffff83c, envp=0xbffff844) at ../../shell/js.cpp:5041
#10 0x0000cada in main (argc=1, argv=0xbffff83c, envp=0xbffff844) at ../../shell/js.cpp:5128

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   49714:13e72485d286
user:        Brian Hackett
date:        Sun Aug 15 08:44:51 2010 -0400
summary:     Add interface for JSStackFrame.fun/script/thisv/rval, bug 586533. r=lw

Comment 3

[Brian Hackett [Laid off!]]

Attachment: fix

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 467016 [details] [diff] [review]
fix

Steal!

/be

Comment 5

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/tracemonkey/rev/61e1128fb57b

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/61e1128fb57b

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/tests/js1_8_5/regress/regress-588339.js.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.