643670 - TI: "Assertion failure: script->compartment->types.inferenceDepth,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

o3 = evalcx("split")
function f3(o) {
    try {
        new o
    } catch(e) {}
}
function f16(o) {
    Object.getOwnPropertyNames(o);
    o.__defineGetter__("prototype", function() {})
}
for (;;) {
    new f3(o3);
    f16(o3)
}

asserts js debug shell on JM changeset 55f463c562d4 with -m, -a and -n at Assertion failure: script->compartment->types.inferenceDepth

Comment 1

[Brian Hackett [Laid off!]]

In a couple places we call js_GetScriptedCaller to update its types, which can get a script in another compartment if there was a cross-compartment call.  Watch for this, and also add assertions that we don't try to analyze scripts where the script->compartment != cx->compartment.

This picked up such an instance in JS_ClearTrap, which may recompile a script from a different compartment.  The patch updates cx->compartment around this call (what's the right way to do this?), not sure if this should also go into TM.

http://hg.mozilla.org/projects/jaegermonkey/rev/75906fcd8426

Comment 2

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929