Last Comment Bug 745360 - IonMonkey: Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFrame::isNonEvalFunctionFrame] or "Assertion failure: isInterpreted(),"
: IonMonkey: Crash [@ js::ArgumentsObject::createUnexpected] or [@ js::StackFra...
Status: RESOLVED FIXED
[Leave open after IonMonkey merge] [j...
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86 Mac OS X
: -- critical (vote)
: mozilla14
Assigned To: Nicolas B. Pierron [:nbp]
:
Mentors:
Depends on:
Blocks: jsfunfuzz IonFuzz 732853 744670
  Show dependency treegraph
 
Reported: 2012-04-13 15:20 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:08 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (7.67 KB, text/plain)
2012-04-13 15:20 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
stack on mozilla-inbound rev 662c163ac088 (7.09 KB, text/plain)
2012-04-13 15:34 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
Opt shell stack on mozilla-inbound rev 662c163ac088 (6.06 KB, text/plain)
2012-04-13 15:40 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
Native calls are not function frames. (3.73 KB, patch)
2012-04-13 16:57 PDT, Nicolas B. Pierron [:nbp]
luke: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-04-13 15:20:25 PDT
Created attachment 614928 [details]
stack

newGlobal('new-compartment').eval("eval.arguments")

asserts js debug shell on IonMonkey changeset e78cfa69741e without any CLI arguments at Assertion failure: isInterpreted(),

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   91388:2386dfe53a85
user:        Nicolas Pierron
date:        Fri Mar 23 20:30:57 2012 -0700
summary:     Rewrite fun_getProperty to handle Ion Frames (Bug 732853 part 2, r=dvander)
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-04-13 15:34:14 PDT
Created attachment 614933 [details]
stack on mozilla-inbound rev 662c163ac088

Crashes at js::StackFrame::isNonEvalFunctionFrame on mozilla-inbound rev 662c163ac088 instead.
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2012-04-13 15:40:18 PDT
Created attachment 614935 [details]
Opt shell stack on mozilla-inbound rev 662c163ac088

Crashes opt shell at js::ArgumentsObject::createUnexpected too. Seems to be a null deref.
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2012-04-13 15:47:16 PDT
The mozilla-inbound regression is likely to be bug 744670.
Comment 4 Nicolas B. Pierron [:nbp] 2012-04-13 16:57:37 PDT
Created attachment 614957 [details] [diff] [review]
Native calls are not function frames.
Comment 5 Nicolas B. Pierron [:nbp] 2012-04-13 18:32:43 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/dcb1ba052c35
Comment 6 :Ms2ger (⌚ UTC+1/+2) 2012-04-14 06:38:19 PDT
https://hg.mozilla.org/mozilla-central/rev/dcb1ba052c35
Comment 7 Nicolas B. Pierron [:nbp] 2012-04-14 14:07:24 PDT
This bug should not be closed because it also affects IonMonkey. (see title & whiteboard)
Thanks for your concern.
Comment 8 Christian Holler (:decoder) 2012-04-18 10:48:17 PDT
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 0e6d579045c8).
Comment 9 Nicolas B. Pierron [:nbp] 2012-04-18 11:26:30 PDT
(In reply to Christian Holler (:decoder) from comment #8)
> JSBugMon: The testcase found in this bug no longer reproduces (tried
> revision 0e6d579045c8).

The bug has been correctly merged, thanks for monitoring.
Comment 10 Christian Holler (:decoder) 2013-01-14 08:08:23 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug745360.js.

Note You need to log in before you can comment on or make changes to this bug.