800878 - IonMonkey: Assertion failure: isScript() && !isIon(), at ../../vm/Stack.h:1785

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 1301a72b1c39 (run with --ion-eager):


[1,2,3,4,(':'),6,7,8].forEach(
    function(x) {
        assertEq(evalInFrame(0, ('^')), x);
    }
);

Comment 1

[Christian Holler (:decoder)]

This is triggering quite often. I can delete the evalInFrame function but if it would be fixed that'd be even better :)

Comment 2

[Jan de Mooij [:jandem]]

Testcase uses FastInvoke (for array.forEach), but it's unrelated, this one asserts too:

(function() {
    evalInFrame(0, 'x');
})();

The evalInFrame shell function assumes debug mode is enabled, but doesn't check for it.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   109920:ebeca12019a2
user:        Nicolas B. Pierron
date:        Wed Oct 10 20:41:01 2012 -0700
summary:     Bug 797977 - Rename StackIter::fp() to StackIter::interpFrame(). r=luke

This iteration took 94.587 seconds to run.

Comment 4

[Nicolas B. Pierron [:nbp]]

Attachment: Restrict EvalInFrame to prevent incorrect fuzzer results.

As this is a shell function, the current patch limit it's usage to be used under valid use-cases as JSD is.  Skip this function in deterministic builds because there is no way to predict if a function will been ion-compiled in another run mode. Skip this function and forbids Ion compilation in non-deterministic builds.

Comment 5

[Christian Holler (:decoder)]

Comment on attachment 672155 [details] [diff] [review]
Restrict EvalInFrame to prevent incorrect fuzzer results.

Review of attachment 672155 [details] [diff] [review]:
-----------------------------------------------------------------

With the patch and the test in comment 0 I get:

Assertion failure: InNoGCScope(), at ../../gc/Root.h:417

Comment 6

[Nicolas B. Pierron [:nbp]]

Attachment: EvalInFrame, Check debug mode before iterating the stack.

This should be better as it produce the same error message as the current function (when not ran with --ion-eager) and keep the assertion which ensure that not Ion frames are live when we are debugging.

Comment 7

[Christian Holler (:decoder)]

Comment on attachment 672512 [details] [diff] [review]
EvalInFrame, Check debug mode before iterating the stack.

Fix is working for me, thanks :)

Comment 8

[Luke Wagner [:luke]]

Comment on attachment 672512 [details] [diff] [review]
EvalInFrame, Check debug mode before iterating the stack.

Hah, I much prefer this strategy.

Comment 9

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/20c4309100e1

Comment 10

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/20c4309100e1

Comment 11

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929