621943 - JM: Crash [@ js_TraceObject] or "Assertion failure: !argsobj.getPrivate(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f1(code) {
    f = Function(code)
    v = f2(f, code);
    try {
        for (e in rv)
        {
            n
        }
    } catch(r) {}
}
function f2(f, e) {
        rv = f()
}
f1("\"use strict\";for each(b in[0]){(eval(yield[]))}")
f1("gc()")

asserts js debug shell on TM changeset 2e3df1dda85 with -m at Assertion failure: !argsobj.getPrivate(), and crashes at js_TraceObject.

Assuming s-s because this involves gc.

Opt backtrace:

(gdb) bt
#0  0x00000008 in ?? ()
Cannot access memory at address 0x8
#1  0x000b89fa in js_TraceObject ()
#2  0x000b8e5f in js_TraceObject ()
#3  0x0007003c in js::gc::MarkChildren ()
#4  0x0007a2c8 in js_TraceStackFrame ()
#5  0x000a0dc8 in generator_trace ()
#6  0x000b89fa in js_TraceObject ()
#7  0x000b8e5f in js_TraceObject ()
#8  0x0007003c in js::gc::MarkChildren ()
#9  0x000702d0 in js::gc::MarkChildren ()
#10 0x000702df in js::gc::MarkChildren ()
#11 0x000702df in js::gc::MarkChildren ()
#12 0x0007e076 in js::MarkIfGCThingWord ()
#13 0x000749bb in js::MarkRuntime ()
#14 0x00076432 in GCUntilDone ()
#15 0x0007808b in js_GC ()
#16 0x000130aa in JS_GC ()
#17 0x00007059 in GC ()
#18 0x0022c19c in CallCompiler::generateNativeStub ()
#19 0x0022b8fb in js::mjit::ic::NativeCall ()
#20 0x006c4095 in ?? ()
#21 0x001d477a in js::mjit::JaegerShot ()
#22 0x0009645a in js::Invoke ()
#23 0x0023e100 in js::mjit::stubs::SlowCall ()
#24 0x0022a6b5 in SlowCallFromIC ()
#25 0x006c3c4d in ?? ()
#26 0x001d477a in js::mjit::JaegerShot ()
#27 0x00095d83 in js::Execute ()
#28 0x00018db8 in JS_ExecuteScript ()
#29 0x00006464 in Process ()
#30 0x0000ad02 in Shell ()
#31 0x0000b29f in main ()
(gdb) x/i $eip
0x8:    Cannot access memory at address 0x8

Comment 1

[Jeff Walden [:Waldo]]

Thought this was a dup, still reproduces in my tree even with bug 620335 fixed -- will investigate.

Comment 2

[Jeff Walden [:Waldo]]

Attachment: Same song, second verse

...plus an extra tweak to assert more than I'd originally done in bug 620335.

Comment 3

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/1b62c516b291

Comment 4

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/1b62c516b291

Comment 5

[Christian Holler (:decoder)]

Tracer bug, marking VERIFIED due to tracer removal.