656229 - TI: "Assertion failure: isNumber(),"

Status: RESOLVED DUPLICATE of bug 655950

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

''.replace(/a/, (function() {
    return Math.pow
})())

asserts js debug shell on JM changeset fd1abc43d698 with -m, -a and -n at Assertion failure: isNumber(),

(gdb) bt
#0  0xf7fdf430 in __kernel_vsyscall ()
#1  0xf7fb5ba0 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:42
#2  0x081fda8d in JS_Assert (s=0x83cc270 "isNumber()", file=0x83cc1d0 "/home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsvalue.h", ln=607)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsutil.cpp:89
#3  0x0807e899 in js::Value::toNumber (this=0xf76e4080) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsvalue.h:607
#4  0x081d51c5 in ArgToRootedString (cx=0x84e4028, argc=2, vp=0xf76e4080, arg=1) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsstr.cpp:451
#5  0x081da3ed in js::str_replace (cx=0x84e4028, argc=2, vp=0xf76e4068) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsstr.cpp:2538
#6  0x0812b732 in js::CallJSNative (cx=0x84e4028, native=0x81da107 <js::str_replace(JSContext*, uintN, js::Value*)>, argc=2, vp=0xf76e4068)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jscntxtinlines.h:293
#7  0x0839a79b in js::Interpret (cx=0x84e4028, entryFrame=0xf76e4030, inlineCallCount=0, interpMode=js::JSINTERP_SAFEPOINT)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsinterp.cpp:4735
#8  0x08354b19 in js_InternalInterpret (returnData=0xf7517140, returnType=0xffff0007, returnReg=0x82b6370, f=...)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/methodjit/InvokeHelpers.cpp:1621
#9  0x082b6348 in JaegerInterpoline () at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/methodjit/MethodJIT.cpp:152
#10 0x000f4240 in ?? ()
#11 0x00000000 in ?? ()

Comment 1

[Brian Hackett [Laid off!]]

WFM, and this hits the busted cast fixed in bug 655950, so I'm guessing that's the problem.  Reopen if you can still repro.

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 655950).