680976 - TI: "Assertion failure: stackDepth >= nuses,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

The attached testcase asserts at Assertion failure: stackDepth >= nuses, on JM changeset 8fe193e034cb with -m and -a, on Windows 7 debug shell.

This was found using a triple combination of an existing js test, jsfunfuzz and jandem's method fuzzer. Eventually the reduced testcase revealed jsfunfuzz was not needed for the assert.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Probably JM-only, doesn't occur on mc changeset 33e4aa663bba.

Thanks Luke who confirms via IRC that it doesn't on 64-bit Linux debug shell (assuming mozilla-central).

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

For decomposed incops which needed an INDEXBASE opcode to adjust their atom operand, the resulting bytecode was deformed --- a RESETBASE opcode must be emitted after such ops, and it was taking the place of the one-byte decomposed length attached to these ops.

http://hg.mozilla.org/projects/jaegermonkey/rev/a30c64a27b4a