675921 - TI: "Assertion failure: codeArray[offset]," with trap

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function g() {
    var a
    trap(f, 20, a)
}
String.prototype.__proto__.r = 6
f = Function("L:for(var y in 3){return}")
g()(typeof f())

asserts js debug shell on JM changeset 674160662e80 with -m, -a, -d and -n at Assertion failure: codeArray[offset],

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

Comment 1

[Brian Hackett [Laid off!]]

When rejoining into the interpreter we compute the sp of the next opcode (only used in certain circumstances) but did not account for rejoins at opcodes with no fallthrough and an unreachable successor.

http://hg.mozilla.org/projects/jaegermonkey/rev/a82d5a5e070e