JM: "Assertion failure: asCall().maybeStackFrame() != NULL," with trap

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-needed)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 563348 [details]
stack

function g(s) {
  var c;
  return eval(s);
}
f = g("\
  (function() {\
    for each(let w in []) {\
      let(w) {\
        for (a = 0; a < 2; ++a) {\
          if (a % 11 == 2) {\
            (NaN);\
          } else {\
            ({\
              a1: 1\
            });\
          }\
        }\
      }\
    }\
  });\
");
var o = {}.__proto__
for (var i = 0; i < 2; i++) {
    var props = Object.getOwnPropertyNames(o)
    var prop = props[props.length - 1] + "p"
    o[prop] = Uint8ClampedArray()
}
dis(f)
trap(f, 107, '')
f()

asserts js debug shell on JM changeset 44ef245b8706 with -m, -a and -d at Assertion failure: asCall().maybeStackFrame() != NULL,

Sometimes removing the "var c;" line near the top causes Assertion failure: !obj->isBlock(), but doesn't occur with this testcase.
(Reporter)

Comment 1

6 years ago
Tested on 64-bit Mac OS X 10.6 js shell.
(Reporter)

Comment 2

6 years ago
Also occurs on 32-bit Mac m-c rev dbb129f069b1.
(Reporter)

Comment 3

6 years ago
This was found using a combination of jsfunfuzz and jandem's method fuzzer.
Depends on: 692274
When JS_GetFrameScopeChain is called via the trap, it changes the layout of the scope chain and causes the BINDNAME IC to push the wrong object.
(Reporter)

Comment 5

6 years ago
Probably fixed by bug 706611.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   81128:d32ccb2b8a05
user:        Brian Hackett
date:        Thu Dec 01 15:13:51 2011 -0800
summary:     Remove JSOP_NOTRACE, rename JSOP_TRACE -> JSOP_LOOPHEAD, bug 706611. r=dvander
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED

Updated

5 years ago
No longer depends on: 692274
You need to log in before you can comment on or make changes to this bug.