728191 - Assertion failure: regs.fp()->prev() == regs_->fp(), at js/src/vm/Stack.cpp:338

Status: RESOLVED DUPLICATE of bug 752379

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 78fde7e54d92 (options -m -n -a):


var lfcode = new Array();
lfcode.push("");
lfcode.push("var summary = 'Let expression error involving undefined';");
while (true) {
        var file = lfcode.shift(); if (file == undefined) { break; }
        loadFile(file);
}
function loadFile(lfVarx) {
        evaluate(lfVarx);
}


It would be good if this could be fixed quickly although it's not security critical, because the bug is easy to reproduce and makes minimization of other issues harder (as they can morph into this one). It seems to depend on TI.

Comment 1

[Brian Hackett [Laid off!]]

Is there a blame cset for this bug?

Comment 2

[Jesse Ruderman]

~/fuzzing/js-autobisect/autoBisect.py  -p -a 64 --flags="-m,-n,-a" -o "->prev()" ~/Desktop/p.js

(plus some hacking)

The first bad revision is:
changeset:   752fddcf2d1d
user:        Brian Hackett
date:        Mon Jul 25 08:57:00 2011 -0700
summary:     [INFER] Only allow inlined frames to call other frames in the same VMFrame, bug 673763.

Comment 3

[David Mandelin [:dmandelin]]

Christian, is this still crimping your fuzzing?

Comment 4

[Christian Holler (:decoder)]

Nope, I haven't seen this for quite a while. I'll try a bisect later or tomorrow to see what fixed this.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision ee1fb253dfce).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   93900:b6ce79884966
user:        Luke Wagner
date:        Mon May 07 09:15:08 2012 -0700
summary:     Bug 752379 - ContextStack::pushExecuteFrame should read the most recent 'fp' (r=bhackett)

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 752379).