768850 - Assertion failure: i < numFormalArgs(), at vm/Stack-inl.h:249 or Opt-crash [@ numFormalArgs] or Opt-crash [@ QuoteString]

Status: RESOLVED DUPLICATE of bug 772012

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts/crashes on mozilla-central revision be373f4b243f (options -m -n):


function testLengthOnNonNativeProto(p = parseInt(-x[i]), ... foo) {
  var o = {};
  for (var j = 0; j < 5; j++)
    o2.length;
  function foo() { }
}
testLengthOnNonNativeProto(this);



In a 32-bit opt build, the crash looks like this:

==17725== Invalid read of size 2
==17725==    at 0x80C1E3A: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (Stack-inl.h:301)
==17725==    by 0x80CB140: js::RunScript(JSContext*, JSScript*, js::StackFrame*) (jsinterp.cpp:267)
==17725==    by 0x80CBCEF: js::Execute(JSContext*, JSScript*, JSObject&, JS::Value*) (jsinterp.cpp:455)
[...]
==17725==  Address 0xffffff92 is not stack'd, malloc'd or (recently) free'd


Using a 64 bit build I get a different sig:

==18368== Invalid read of size 2
==18368==    at 0x4A5250: QuoteString(js::Sprinter*, JSString*, unsigned int) (jsopcode.cpp:951)
==18368==    by 0x4A55C3: js_QuoteString (jsopcode.cpp:1012)
==18368==    by 0x4D796C: js_ValueToPrintable(JSContext*, JS::Value const&, JSAutoByteString*, bool) (jsstr.cpp:3232)
==18368==    by 0x42DC4E: js_AtomToPrintableString(JSContext*, JSAtom*, JSAutoByteString*) (jsatom.cpp:55)
==18368==    by 0x47230A: js::NameOperation(JSContext*, unsigned char*, JS::Value*) (jsinterpinlines.h:361)
==18368==    by 0x473DFE: js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) (jsinterp.cpp:2545)
==18368==    by 0x47F02E: js::RunScript(JSContext*, JSScript*, js::StackFrame*) (jsinterp.cpp:267)
[...]
==18368==  Address 0x2 is not stack'd, malloc'd or (recently) free'd


Both look like null pointers involved, but in different directions. The fact that the crash sigs are different across architectures isn't a good sign though. Assuming this is s-s until confirmed that it's a harmless crash in all cases.

Comment 1

[Christian Holler (:decoder)]

Another test in the fuzzer raises the same assert but crashes [@ js::mjit::JITScript::nativeToPC].

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 7fe96a690596).

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   99134:03e30c5fde87
user:        Benjamin Peterson
date:        Thu Jul 12 19:28:54 2012 -0400
summary:     Bug 772012 - When the rest parameter aliases a function and defaults are present, don't try to set the rest parameter. r=jorendorff

Comment 4

[Christian Holler (:decoder)]

Likely a duplicate of bug 772012 then. Benjamin, can I close this one as dup?

Comment 5

[Jason Orendorff [:jorendorff]]

Luke, is this a dup of bug 772012.