690285 - JM: "Assertion failure: asCall().maybeStackFrame() != NULL," with trap

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function g(s) {
  var c;
  return eval(s);
}
f = g("\
  (function() {\
    for each(let w in []) {\
      let(w) {\
        for (a = 0; a < 2; ++a) {\
          if (a % 11 == 2) {\
            (NaN);\
          } else {\
            ({\
              a1: 1\
            });\
          }\
        }\
      }\
    }\
  });\
");
var o = {}.__proto__
for (var i = 0; i < 2; i++) {
    var props = Object.getOwnPropertyNames(o)
    var prop = props[props.length - 1] + "p"
    o[prop] = Uint8ClampedArray()
}
dis(f)
trap(f, 107, '')
f()

asserts js debug shell on JM changeset 44ef245b8706 with -m, -a and -d at Assertion failure: asCall().maybeStackFrame() != NULL,

Sometimes removing the "var c;" line near the top causes Assertion failure: !obj->isBlock(), but doesn't occur with this testcase.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Tested on 64-bit Mac OS X 10.6 js shell.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Also occurs on 32-bit Mac m-c rev dbb129f069b1.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

Comment 4

[Brian Hackett [Laid off!]]

When JS_GetFrameScopeChain is called via the trap, it changes the layout of the scope chain and causes the BINDNAME IC to push the wrong object.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Probably fixed by bug 706611.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   81128:d32ccb2b8a05
user:        Brian Hackett
date:        Thu Dec 01 15:13:51 2011 -0800
summary:     Remove JSOP_NOTRACE, rename JSOP_TRACE -> JSOP_LOOPHEAD, bug 706611. r=dvander