622318 - TM: Crash [@ js::Interpret] or "Assertion failure: regs.sp[-1].isObject(),"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    for (window = (0
    for (x in V)); f;) {}
} catch(e) {}
for each(let z in [0, 0, 0, 0, 0, 0, 0, 0, 0]) {
    for (v in window) {}
}
var e, V

asserts js debug shell on TM changeset e0fc487c23f4 with -j when passed in as a CLI argument at Assertion failure: regs.sp[-1].isObject(), and crashes js opt shell at js::Interpret.

Setting s-s just-in-case.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   58599:9acf849c97b4
user:        Luke Wagner
date:        Fri Nov 19 15:09:03 2010 -0800
summary:     Bug 612523 - unfuse JSOP_MOREITER; sanity returns (r=dvander,gal)

Opt shell console output:

(gdb) bt
#0  0x00086648 in js::Interpret ()
#1  0x00096636 in js::Execute ()
#2  0x00018928 in JS_ExecuteScript ()
#3  0x00006309 in Process ()
#4  0x0000a862 in Shell ()
#5  0x0000adff in main ()
(gdb) x/i $eip
0x86648 <_ZN2js9InterpretEP9JSContextP12JSStackFramej12JSInterpMode+28808>:     cmp    %eax,0x4(%edx)
(gdb) x/b $eax
0x2afec0 <js_IteratorClass>:    0x02
(gdb) x/b $edx
0x0:    Cannot access memory at address 0x0

Comment 1

[Luke Wagner [:luke]]

Attachment: fix

Thinko -- inverted check emitted.  This would have been obvious if pendingGuardCondition's use wasn't so far away from where its definition.

Comment 2

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/2e57743aeca6

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/2e57743aeca6

Comment 4

[Christian Holler (:decoder)]

Luke, did this affect 1.9.2? Any reason to keep this locked?

Comment 5

[Luke Wagner [:luke]]

Nope.

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929