Last Comment Bug 700792 - [ObjShrink] "Assertion failure: isScope()," with trap
: [ObjShrink] "Assertion failure: isScope()," with trap
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: ---
Assigned To: Brian Hackett (:bhackett)
:
Mentors:
Depends on:
Blocks: jsfunfuzz 694247
  Show dependency treegraph
 
Reported: 2011-11-08 13:36 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2011-11-16 11:47 PST (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (3.44 KB, text/plain)
2011-11-08 13:36 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
patch (725 bytes, patch)
2011-11-09 10:03 PST, Brian Hackett (:bhackett)
luke: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-11-08 13:36:08 PST
Created attachment 572990 [details]
stack

f = Function("\
    for(let z in [0,,,,,,,0]) {\
        for each (let z in [,,,,,,,,0,,0]) {\
            print(<y/>)\
        }\
    }\
")
trap(f, 155, '')
f()

asserts js debug shell on JM changeset 1210706b4576 with patch v1 from bug 697279 with -d at Assertion failure: isScope(),

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   78136:7b634ad714fd
user:        Brian Hackett
date:        Wed Oct 12 22:29:43 2011 -0700
summary:     Move scope chains of scope objects to reserved slots, bug 694247.
Comment 1 Brian Hackett (:bhackett) 2011-11-09 10:03:26 PST
Created attachment 573238 [details] [diff] [review]
patch

Property cache entries are only filled when all the scope objects are internal (call/block/etc.) or global, and when testing PropertyCache::fullTest assumed an isomorphic chain.  This breaks in debug mode as the debugger can induce construction of new scope objects.

This behavior of lazily creating new scope objects doesn't seem outright wrong but does seem pretty weird.  Will this be going away with bug 659577?
Comment 2 Brian Hackett (:bhackett) 2011-11-09 10:04:50 PST
https://hg.mozilla.org/projects/jaegermonkey/rev/0c887d263ec6
Comment 3 Luke Wagner [:luke] 2011-11-16 11:45:08 PST
(In reply to Brian Hackett from comment #1)
> This behavior of lazily creating new scope objects doesn't seem outright
> wrong but does seem pretty weird.  Will this be going away with bug 659577?

They may be created, but they won't be inserted onto the frame's scope chain.  Rather, they will just be on the (new) scope chain for the debugger's eval.

Note You need to log in before you can comment on or make changes to this bug.