662841 - TI: "Assertion failure: script->code <= pc && pc < endpc,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

var e = newGlobal("new-compartment");
for (let w in [0, 0, 0, 0, 0, 0, 0, 0]) {
    -e;
}

asserts js debug shell on JM changeset a53db4f2d235 with -j at Assertion failure: script->code <= pc && pc < endpc,

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   71039:afe33041f481
user:        Brian Hackett
date:        Tue Jun 07 17:44:07 2011 -0700
summary:     [INFER] Make sure to get the topmost scripted frame's pc in ContextStack::currentScript, bug 662562.

Comment 2

[Brian Hackett [Laid off!]]

The problem is that using currentScript in js_InferFlags made a very subtle change to the semantics, where we called Detecting when the topmost frame is a dummy frame (for a cross compartment wrapper), breaking the assert being tripped here (as cx->fp() does not correspond to the script being tested).

I'd like to fix this by making stack.currentScript and stack.currentScriptedScopeChain return NULL if the topmost scripted frame is in another compartment.  I don't think there's any sane way we could behave by trying to use a frame or script from another compartment.  It would also be nice to do this for js_GetScriptedCaller, but this is used by the debug API and I have no idea what behavior is expected here.  Luke, thoughts?

Comment 3

[Brian Hackett [Laid off!]]

Return NULL for currentScript() if the topmost scripted frame is in a different compartment from cx->compartment.  Doesn't change js_GetScriptedCaller's behavior, though this function isn't called much now that currentScript and currentScriptedScopeChain exist.  currentScriptedScopeChain is already guaranteed to return an object from cx->compartment.

http://hg.mozilla.org/projects/jaegermonkey/rev/279a046a56cd

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug662841.js.