652414 - TI: Crash [@ js::GetIterator] or "Assertion failure: v.isNumber() || v.isBoolean(),"

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

x = eval("");
(function() {
    x = ''
})()
try {
    (function() {
        function a(b) {
            for (v in b) {}
        }
        for each(z in [x]) {
            a(z)
        }
    })()
} catch(e) {}

asserts js debug shell on JM changeset 90a7b141e0cf with -m, -a, -n and -d at Assertion failure: v.isNumber() || v.isBoolean(), and turns into a crash in js::GetIterator if the first line above is changed to:

x = eval

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Tested on 64-bit.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   68276:90a7b141e0cf
tag:         tip
user:        Brian Hackett
date:        Fri Apr 22 07:59:45 2011 -0700
summary:     [INFER] Bytecode SSA analysis, bug 650715.

Comment 2

[Brian Hackett [Laid off!]]

Hmm, WFM on tip.  This may have been fixed by rev a16bbfe4f0f4, which reverted a case where inference broke some invariants in compartments with debug mode.