661838 - TM: "Assertion failure: op != JSOP_TRAP," with trap

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

f = (function() {
  function g() {
    ""
    ({})
  }
  for (let d in [,,,,0]) {
    try {
      let u = new g(d)
      t('');
      /x/._("", function() {})[[5, 6, 7, 8].r(h.x, x)]
    } catch (e) {}
  }
});
dis(f)
trap(f, 138, '')
f();

asserts js debug shell on TM changeset b0d93728d58c with "-d -m -j -a -p" CLI parameters on Windows 7 at Assertion failure: op != JSOP_TRAP,

js> dis(f)
flags: LAMBDA NULL_CLOSURE
off     op
-----   --
main:
00000:  deflocalfun 0 function g() {""({});}
00005:  nullblockchain
00006:  nop
00007:  enterblock depth 0 {d: 0}
00010:  newarray 5
00014:  zero
00015:  hole
00016:  initelem
00017:  one
00018:  hole
00019:  initelem
00020:  int8 2
00022:  hole
00023:  initelem
00024:  int8 3
00026:  hole
00027:  initelem
00028:  int8 4
00030:  zero
00031:  initelem
00032:  endinit
00033:  iter 1
00035:  goto 154 (119)
00038:  trace 0
00041:  forlocal 1
00044:  try
00045:  enterblock depth 2 {u: 0}
00048:  getlocal 0
00051:  push
00052:  getlocal 1
00055:  new 1
00058:  setlocal 3
00061:  pop
00062:  callgname "t"
00065:  string ""
00068:  call 1
00071:  pop
00072:  regexp /x/
00075:  callprop "_"
00078:  string ""
00081:  lambda (function () {})
00084:  blockchain depth 2 {u: 0}
00087:  call 2
00090:  newarray 4
00094:  zero
00095:  int8 5
00097:  initelem
00098:  one
00099:  int8 6
00101:  initelem
00102:  int8 2
00104:  int8 7
00106:  initelem
00107:  int8 3
00109:  int8 8
00111:  initelem
00112:  endinit
00113:  callprop "r"
00116:  getgname "h"
00119:  getprop "x"
00122:  getgname "x"
00125:  call 2
00128:  getelem
00129:  pop
00130:  leaveblock 1
00135:  goto 154 (19)
00138:  enterblock depth 2 {e: 0}       <-- trap goes here
00141:  exception
00142:  setlocalpop 3
00145:  leaveblock 1
00150:  goto 154 (4)
00153:  nop
00154:  moreiter
00155:  ifne 38 (-117)
00158:  enditer
00159:  leaveblock 1
00164:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:    1     0 [   0] newline
  1:    2     6 [   6] funcdef  function 0 (function g() {""({});})
  3:    2     7 [   1] setline  lineno 6
  5:    6    35 [  28] xdelta
  6:    6    35 [   0] if-else  else 9 elseif 120
  9:    6    38 [   3] while    offset 117
 11:    6    41 [   3] decl     offset 2
 13:    6    44 [   3] newline
 14:    7    48 [   4] newline
 15:    8    55 [   7] pcbase   offset 7
 17:    8    58 [   3] decl     offset 2
 19:    8    62 [   4] newline
 20:    9    68 [   6] pcbase   offset 6
 22:    9    72 [   4] newline
 23:   10    75 [   3] pcbase   offset 3
 25:   10    87 [  12] xdelta
 26:   10    87 [   0] pcbase   offset 15
 28:   10   113 [  26] xdelta
 29:   10   113 [   0] pcbase   offset 23
 31:   10   119 [   6] pcbase   offset 3
 33:   10   125 [   6] pcbase   offset 35
 35:   10   128 [   3] pcbase   offset 56
 37:   10   135 [   7] hidden
 38:   10   138 [   3] catch
 40:   10   138 [   0] newline
 41:   11   145 [   7] catch    stack depth 3
 43:   11   150 [   5] hidden
 44:   11   153 [   3] endbrace
 45:   11   164 [  11] xdelta
 46:   11   164 [   0] newline

Exception table:
kind      stack    start      end
 catch        2       45      138
 iter         2       38      158

js> trap(f, 138, '')
js> f();
Assertion failure: op != JSOP_TRAP,

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Tested to also occur on a 32-bit debug shell on Ubuntu Linux 11.04 64-bit.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

WORKSFORME on JM changeset e0b67d8cc908 with patch v1 from bug 672892.