Last Comment Bug 732860 - IonMonkey: Assertion failure: index < natoms, at ../../jsscript.h:735
: IonMonkey: Assertion failure: index < natoms, at ../../jsscript.h:735
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: Nicolas B. Pierron [:nbp]
:
: Jason Orendorff [:jorendorff]
Mentors:
: 729813 (view as bug list)
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-03-04 18:06 PST by Christian Holler (:decoder)
Modified: 2013-01-14 08:26 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Fix Pc recovery in js_DecompileValueGenerator (1.71 KB, patch)
2012-03-13 15:40 PDT, Nicolas B. Pierron [:nbp]
dvander: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-03-04 18:06:39 PST
The following testcase asserts on ionmonkey revision 1fd6c40d3852 (run with --ion -n -m --ion-eager):


function trySetProperty(o, p, v, strict) {
  function strictSetProperty()  {
    "use strict";
    o[p] = v;
  }
  try  {
      strictSetProperty();
  }  catch (e)  {
    return "throw";
  }
}
var slowArray = [1, 2, 3];
var objs =
  [{}, { 1: 2 }, { a: 3 }, [], [00 ], [, 1], slowArray, function a(){}, /a/];
for (var i = 0, sz = objs.length; i < sz; i++) {
  var o = objs[i];
  var o2 = Object.preventExtensions(o);
  assertEq(trySetProperty(o, "baz", 17, true), "throw", "object " + i);
}
Comment 1 Nicolas B. Pierron [:nbp] 2012-03-13 15:40:22 PDT
Created attachment 605575 [details] [diff] [review]
Fix Pc recovery in js_DecompileValueGenerator
Comment 2 David Anderson [:dvander] 2012-03-13 15:56:17 PDT
Comment on attachment 605575 [details] [diff] [review]
Fix Pc recovery in js_DecompileValueGenerator

Review of attachment 605575 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsopcode.cpp
@@ +5674,5 @@
>      if (!cx->hasfp() || !cx->fp()->isScriptFrame())
>          goto do_fallback;
>  
>      fp = js_GetTopStackFrame(cx, FRAME_EXPAND_ALL);
> +    script = cx->stack.currentScript(&pc);

Nice catch. I'm concerned about that js_GetTopStackFrame call there, but we can worry about it later :)
Comment 3 Nicolas B. Pierron [:nbp] 2012-03-13 16:07:37 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/e5b9b7441a4e
Comment 4 Nicolas B. Pierron [:nbp] 2012-03-14 18:55:44 PDT
*** Bug 729813 has been marked as a duplicate of this bug. ***
Comment 5 Christian Holler (:decoder) 2013-01-14 08:26:48 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug732860.js.

Note You need to log in before you can comment on or make changes to this bug.