659043 - TI: "Assertion failure: ix == jit->nNmapPairs," with trap

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, critical)

Description

[Gary Kwong [:gkw] [:nth10sd]]

f = (function() {
  for (let a = 0; a < 0; ++a) {
    for each(let w in []) {}
  }
})
dis(f)
trap(f, 27, undefined);
for (b in f())
  (function() {})()

asserts js debug shell on JM changeset 29f08848d96c with -m, -a, -d and -n at Assertion failure: ix == jit->nNmapPairs,

flags: LAMBDA NULL_CLOSURE
off     op
-----   --
main:
00000:  enterblock depth 0 {a: 0}
00003:  zero
00004:  setlocal 0
00007:  pop
00008:  goto 47 (39)
00011:  trace 0
00014:  enterblock depth 1 {w: 0}
00017:  newarray 0
00021:  endinit
00022:  iter 3
00024:  goto 33 (9)
00027:  trace 1            <-- trap goes here
00030:  forlocal 1
00033:  moreiter
00034:  ifne 27 (-7)
00037:  enditer
00038:  leaveblock 1
00043:  inclocal 0
00046:  pop
00047:  getlocal 0
00050:  zero
00051:  lt
00052:  ifne 11 (-41)
00055:  leaveblock 1
00060:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:    1     0 [   0] newline 
  1:    2     4 [   4] decl     offset 2
  3:    2     7 [   3] for      cond 39 update 35 tail 44
  7:    2    11 [   4] while    offset 41
  9:    2    14 [   3] newline 
 10:    3    24 [  10] xdelta  
 11:    3    24 [   0] if-else  else 9 elseif 10
 14:    3    27 [   3] while    offset 7
 16:    3    30 [   3] decl     offset 2
 18:    3    43 [  13] xdelta  
 19:    3    43 [   0] setline  lineno 2
 21:    2    47 [   4] setline  lineno 3
 23:    3    47 [   0] setline  lineno 2
 25:    2    60 [  13] xdelta  
 26:    2    60 [   0] setline  lineno 4

Exception table:
kind      stack    start      end
 iter         3       27       37

js> trap(f, 27, undefined);
js> for (b in f())
  (function() {})()
Assertion failure: ix == jit->nNmapPairs,

Comment 1

[Brian Hackett (:bhackett)]

Fix trap handling.  Is it possible for the debugger to actually add a trap at a TRACE opcode?

http://hg.mozilla.org/projects/jaegermonkey/rev/79746474b25a