656230 - TI: "Assertion failure: Unknown value,"

Status: RESOLVED DUPLICATE of bug 655950

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f() {}
var a = new f;

asserts js debug shell on JM changeset fd1abc43d698 with -m, -a and -n at Assertion failure: Unknown value,

(gdb) bt
#0  0xf7fdf430 in __kernel_vsyscall ()
#1  0xf7fb5ba0 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:42
#2  0x081fda8d in JS_Assert (s=0x83ccda0 "Unknown value", file=0x83ccd1c "/home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsinferinlines.h", ln=80)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsutil.cpp:89
#3  0x08080fba in js::types::GetValueType (cx=0x84e4028, val=...) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsinferinlines.h:80
#4  0x08112b16 in js::types::TypeCompartment::dynamicAssign (this=0x84e49c8, cx=0x84e4028, obj=0xf75020a8, id=..., rval=...)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsinfer.cpp:1997
#5  0x08355ae5 in JSContext::typeMonitorAssign (this=0x84e4028, obj=0xf75020a8, id=..., rval=...) at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsinferinlines.h:452
#6  0x08397d7a in js::Interpret (cx=0x84e4028, entryFrame=0xf76e4030, inlineCallCount=0, interpMode=js::JSINTERP_SAFEPOINT)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/jsinterp.cpp:4280
#7  0x08354b19 in js_InternalInterpret (returnData=0xf750f048, returnType=0xffff0007, returnReg=0x82b6370, f=...)
    at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/methodjit/InvokeHelpers.cpp:1621
#8  0x082b6348 in JaegerInterpoline () at /home/fuzz1/Desktop/jsfunfuzz-dbg-32-jm-69167-fd1abc43d698/compilePath/js/src/methodjit/MethodJIT.cpp:152
#9  0x000f4240 in ?? ()
#10 0x00000000 in ?? ()

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I've seen the following assertion:

Assertion failure: !unknownProperties(),

with testcases that eventually get reduced to display the Unknown value assert.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #1)
> I've seen the following assertion:
> 
> Assertion failure: !unknownProperties(),

See also bug 656252.

Comment 3

[Brian Hackett [Laid off!]]

WFM, and this hits the busted cast fixed in bug 655950, so I'm guessing that's the problem.

Sorry for the trouble!  I need to start testing on non-OSX platforms, will get Linux and Windows VMs installed today.

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 655950).