Last Comment Bug 690285 - JM: "Assertion failure: asCall().maybeStackFrame() != NULL," with trap
: JM: "Assertion failure: asCall().maybeStackFrame() != NULL," with trap
Status: RESOLVED FIXED
js-triage-needed
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz 630996
  Show dependency treegraph
 
Reported: 2011-09-29 02:36 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2011-12-13 09:39 PST (History)
6 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (7.10 KB, text/plain)
2011-09-29 02:36 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description Gary Kwong [:gkw] [:nth10sd] 2011-09-29 02:36:11 PDT
Created attachment 563348 [details]
stack

function g(s) {
  var c;
  return eval(s);
}
f = g("\
  (function() {\
    for each(let w in []) {\
      let(w) {\
        for (a = 0; a < 2; ++a) {\
          if (a % 11 == 2) {\
            (NaN);\
          } else {\
            ({\
              a1: 1\
            });\
          }\
        }\
      }\
    }\
  });\
");
var o = {}.__proto__
for (var i = 0; i < 2; i++) {
    var props = Object.getOwnPropertyNames(o)
    var prop = props[props.length - 1] + "p"
    o[prop] = Uint8ClampedArray()
}
dis(f)
trap(f, 107, '')
f()

asserts js debug shell on JM changeset 44ef245b8706 with -m, -a and -d at Assertion failure: asCall().maybeStackFrame() != NULL,

Sometimes removing the "var c;" line near the top causes Assertion failure: !obj->isBlock(), but doesn't occur with this testcase.
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2011-09-29 02:53:44 PDT
Tested on 64-bit Mac OS X 10.6 js shell.
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2011-09-29 18:25:11 PDT
Also occurs on 32-bit Mac m-c rev dbb129f069b1.
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2011-09-29 21:23:53 PDT
This was found using a combination of jsfunfuzz and jandem's method fuzzer.
Comment 4 Brian Hackett (:bhackett) 2011-10-05 19:24:26 PDT
When JS_GetFrameScopeChain is called via the trap, it changes the layout of the scope chain and causes the BINDNAME IC to push the wrong object.
Comment 5 Gary Kwong [:gkw] [:nth10sd] 2011-12-09 15:46:31 PST
Probably fixed by bug 706611.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   81128:d32ccb2b8a05
user:        Brian Hackett
date:        Thu Dec 01 15:13:51 2011 -0800
summary:     Remove JSOP_NOTRACE, rename JSOP_TRACE -> JSOP_LOOPHEAD, bug 706611. r=dvander

Note You need to log in before you can comment on or make changes to this bug.