745360 - IonMonkey: Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

newGlobal('new-compartment').eval("eval.arguments")

asserts js debug shell on IonMonkey changeset e78cfa69741e without any CLI arguments at Assertion failure: isInterpreted(),

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   91388:2386dfe53a85
user:        Nicolas Pierron
date:        Fri Mar 23 20:30:57 2012 -0700
summary:     Rewrite fun_getProperty to handle Ion Frames (Bug 732853 part 2, r=dvander)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack on mozilla-inbound rev 662c163ac088

Crashes at js::StackFrame::isNonEvalFunctionFrame on mozilla-inbound rev 662c163ac088 instead.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Opt shell stack on mozilla-inbound rev 662c163ac088

Crashes opt shell at js::ArgumentsObject::createUnexpected too. Seems to be a null deref.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The mozilla-inbound regression is likely to be bug 744670.

Comment 4

[Nicolas B. Pierron [:nbp]]

Attachment: Native calls are not function frames.

Comment 5

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/dcb1ba052c35

Comment 6

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/dcb1ba052c35

Comment 7

[Nicolas B. Pierron [:nbp]]

This bug should not be closed because it also affects IonMonkey. (see title & whiteboard)
Thanks for your concern.

Comment 8

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 0e6d579045c8).

Comment 9

[Nicolas B. Pierron [:nbp]]

(In reply to Christian Holler (:decoder) from comment #8)
> JSBugMon: The testcase found in this bug no longer reproduces (tried
> revision 0e6d579045c8).

The bug has been correctly merged, thanks for monitoring.

Comment 10

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug745360.js.