The default bug view has changed. See this FAQ.

IonMonkey: Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted(),"

RESOLVED FIXED in mozilla14

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: gkw, Assigned: nbp)

Tracking

(Blocks: 2 bugs, {assertion, regression, testcase})

Other Branch
mozilla14
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [Leave open after IonMonkey merge] [jsbugmon:update,ignore], crash signature)

Attachments

(4 attachments)

(Reporter)

Description

5 years ago
Created attachment 614928 [details]
stack

newGlobal('new-compartment').eval("eval.arguments")

asserts js debug shell on IonMonkey changeset e78cfa69741e without any CLI arguments at Assertion failure: isInterpreted(),

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   91388:2386dfe53a85
user:        Nicolas Pierron
date:        Fri Mar 23 20:30:57 2012 -0700
summary:     Rewrite fun_getProperty to handle Ion Frames (Bug 732853 part 2, r=dvander)
(Reporter)

Comment 1

5 years ago
Created attachment 614933 [details]
stack on mozilla-inbound rev 662c163ac088

Crashes at js::StackFrame::isNonEvalFunctionFrame on mozilla-inbound rev 662c163ac088 instead.
(Reporter)

Updated

5 years ago
Crash Signature: [@ js::StackFrame::isNonEvalFunctionFrame]
Summary: IonMonkey: "Assertion failure: isInterpreted()," → Crash [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted(),"
(Reporter)

Comment 2

5 years ago
Created attachment 614935 [details]
Opt shell stack on mozilla-inbound rev 662c163ac088

Crashes opt shell at js::ArgumentsObject::createUnexpected too. Seems to be a null deref.
(Reporter)

Updated

5 years ago
Crash Signature: [@ js::StackFrame::isNonEvalFunctionFrame] → [@ js::StackFrame::isNonEvalFunctionFrame] [@ js::ArgumentsObject::createUnexpected]
Summary: Crash [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted()," → Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted(),"
(Reporter)

Comment 3

5 years ago
The mozilla-inbound regression is likely to be bug 744670.
Blocks: 744670
(Assignee)

Comment 4

5 years ago
Created attachment 614957 [details] [diff] [review]
Native calls are not function frames.
Assignee: general → nicolas.b.pierron
Status: NEW → ASSIGNED
Attachment #614957 - Flags: review?(luke)

Updated

5 years ago
Attachment #614957 - Flags: review?(luke) → review+
(Assignee)

Comment 5

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/dcb1ba052c35
Summary: Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted()," → IonMonkey: Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted(),"
Whiteboard: [Leave open after IonMonkey merge]
https://hg.mozilla.org/mozilla-central/rev/dcb1ba052c35
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla14
(Assignee)

Comment 7

5 years ago
This bug should not be closed because it also affects IonMonkey. (see title & whiteboard)
Thanks for your concern.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Whiteboard: [Leave open after IonMonkey merge] → [Leave open after IonMonkey merge][jsbugmon:update]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 0e6d579045c8).
Crash Signature: [@ js::StackFrame::isNonEvalFunctionFrame] [@ js::ArgumentsObject::createUnexpected] → [@ js::StackFrame::isNonEvalFunctionFrame] [@ js::ArgumentsObject::createUnexpected]
Whiteboard: [Leave open after IonMonkey merge][jsbugmon:update] → [Leave open after IonMonkey merge] [jsbugmon:update,ignore]
(Assignee)

Comment 9

5 years ago
(In reply to Christian Holler (:decoder) from comment #8)
> JSBugMon: The testcase found in this bug no longer reproduces (tried
> revision 0e6d579045c8).

The bug has been correctly merged, thanks for monitoring.
Status: REOPENED → RESOLVED
Crash Signature: [@ js::StackFrame::isNonEvalFunctionFrame] [@ js::ArgumentsObject::createUnexpected] → [@ js::StackFrame::isNonEvalFunctionFrame] [@ js::ArgumentsObject::createUnexpected]
Last Resolved: 5 years ago5 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug745360.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.