683470 - "Assertion failure: *f.regs.pc == JSOP_CALL || *f.regs.pc == JSOP_NEW || *f.regs.pc == JSOP_EVAL || *f.regs.pc == JSOP_FUNCALL || *f.regs.pc == JSOP_FUNAPPLY," with trap

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: dis() information

f = (function() {
  function b() {
    "use strict";
    Object.defineProperty(this, "x", ({}));
  }
  for each(let d in [0, 0]) {
    try {
      b(d);
    } catch (e) {}
  }
})
dis(f)
trap(f, 54, undefined);
f()

asserts js debug shell on MC changeset fcca99426576 with -m, -a and -d at Assertion failure: *f.regs.pc == JSOP_CALL || *f.regs.pc == JSOP_NEW || *f.regs.pc == JSOP_EVAL || *f.regs.pc == JSOP_FUNCALL || *f.regs.pc == JSOP_FUNAPPLY,

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Not sure if this is related to TI, the assert seems to be at methodjit/InvokeHelpers.cpp:188

Comment 2

[Luke Wagner [:luke]]

Attachment: fix assert

Oops, assert should use js_GetOpcode.

Comment 3

[Luke Wagner [:luke]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/ebfdb0858947

Comment 4

[Ed Morley [:emorley]]

http://hg.mozilla.org/mozilla-central/rev/ebfdb0858947

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug683470.js.