Last Comment Bug 690645 - "Assertion failure: pc_ >= script->code && pc_ < script->code + script->length," with trap
: "Assertion failure: pc_ >= script->code && pc_ < script->code + script->lengt...
Status: RESOLVED FIXED
js-triage-done
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: mozilla10
Assigned To: Luke Wagner [:luke]
:
Mentors:
Depends on:
Blocks: jsfunfuzz
  Show dependency treegraph
 
Reported: 2011-09-29 20:23 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2011-10-05 05:07 PDT (History)
7 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
500-line snipped stack (104.76 KB, text/plain)
2011-09-29 20:23 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
make AutoScriptUntrapper work in-place, tidy up (25.41 KB, patch)
2011-09-30 10:25 PDT, Luke Wagner [:luke]
jwalden+bmo: review+
Details | Diff | Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-09-29 20:23:10 PDT
Created attachment 563642 [details]
500-line snipped stack

function f() {
default xml namespace =
    Proxy.createFunction(function() {
        return {
            get: Namespace,
        };
    }(), Array.isArray);
}
dis(f)
trap(f, 0, '')
f()

asserts 32-bit js debug shell on JM changeset 44ef245b8706 and m-c changeset db9e99d537f2 with -m, -a and -d at Assertion failure: pc_ >= script->code && pc_ < script->code + script->length,


flags: HEAVYWEIGHT
loc     op
-----   --
main:
00000:  getgname "Proxy"   <-- trap goes here
00003:  callprop "createFunction"
00006:  lambda (function () {return {get: Namespace};})
00009:  nullblockchain
00010:  push
00011:  call 0
00014:  getgname "Array"
00017:  getprop "isArray"
00020:  call 2
00023:  defxmlns
00024:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:    1     0 [   0] newline 
  1:    2     0 [   0] newline 
  2:    3     3 [   3] pcbase   offset 3
  4:    3    11 [   8] xdelta  
  5:    3    11 [   0] pcbase   offset 5
  7:    3    14 [   3] setline  lineno 7
  9:    7    17 [   3] pcbase   offset 3
 11:    7    20 [   3] pcbase   offset 20
Comment 1 Luke Wagner [:luke] 2011-09-30 09:23:28 PDT
AutoScriptUntrapper is again repointing script->code so that it is incoherent with cx->regs->pc.  That's it, I'm just going to change it to just mutate the bytecode in-place.
Comment 2 Luke Wagner [:luke] 2011-09-30 10:25:02 PDT
Created attachment 563768 [details] [diff] [review]
make AutoScriptUntrapper work in-place, tidy up

That was surprisingly easy.  While I was touching the code in un-goto-ified things and moved decls inward.
Comment 3 Jeff Walden [:Waldo] (remove +bmo to email) 2011-10-04 15:10:35 PDT
Comment on attachment 563768 [details] [diff] [review]
make AutoScriptUntrapper work in-place, tidy up

Review of attachment 563768 [details] [diff] [review]:
-----------------------------------------------------------------

I wish the declaration-moving stuff had been in a separate patch; most of it looked like it wasn't necessary to the trap-rewriting part.  :-\

::: js/src/jsopcode.cpp
@@ +487,1 @@
>      switch (type) {

You can do |switch (uint32 type = ...)| here, right?
Comment 5 Luke Wagner [:luke] 2011-10-04 15:38:36 PDT
(In reply to Jeff Walden (remove +bmo to email) from comment #3)
> I wish the declaration-moving stuff had been in a separate patch; most of it
> looked like it wasn't necessary to the trap-rewriting part.  :-\

Yeah, sorry.  I only realized that afterwards...
Comment 6 Marco Bonardo [::mak] 2011-10-05 05:07:47 PDT
https://hg.mozilla.org/mozilla-central/rev/76f63c5d3b76

Note You need to log in before you can comment on or make changes to this bug.