784639 - "Assertion failure: pc >= code && pc + sizeof(uint32_t) < code + length,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

evalcx("\
  Object.defineProperty(this, \"a\", {});\
  f = (function(j) {\
	  a = Proxy\
  });\
  Object.defineProperty(this, \"g\", {\
	  get: function() {\
		  return ({\
			  r: function() {},\
			  t: function() {}\
		  })\
	  }\
  });\
  for (p in g) {\
	  f(1)\
  }\
", newGlobal())

asserts js debug shell on m-c changeset abc17059522b with -m, -n and -a at Assertion failure: pc >= code && pc + sizeof(uint32_t) < code + length,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   102943:57c1c330e85f
user:        Luke Wagner
date:        Fri Aug 17 18:09:43 2012 -0700
summary:     Bug 774915 - don't use the property cache for dynamic name lookup (r=bhackett)

Comment 1

[Christian Holler (:decoder)]

Seeing the same here with varying stacks, marking as fuzzblocker.

Comment 2

[Christian Holler (:decoder)]

This bug is also causing security-sensitive crashes on opt builds.

Comment 3

[Luke Wagner [:luke]]

Attachment: fix and test

Gah, why does cx->fp() even still exist?!

Comment 4

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/236d384dc4f9

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/236d384dc4f9

Comment 6

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug784639.js.