868189 - Various assertions found with patches for bug 865059 and bug 867753

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

disassemble("-r", Function("\
    2(function() {\
        1(function() {\
            for (var a = 0; a < 9; a++) {\
                1\
            }\
        })\
    })\
"))

asserts js debug shell on m-i changeset 5ac1564bff87 without any CLI arguments at Assertion failure: tn->kind < ArrayLength(TryNoteNames), at shell/js.cpp

bhackett specially requested for fuzzing this changeset to find regressions to the patch(es) in bug 865059.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Pastebin patch

bhackett requested to use the patch in http://www.pastebin.mozilla.org/2369647 (replicated here) to fuzz again, which has fixes for this bug and bug 867753.

This likely found:

evalcx("for each(c in print())''", newGlobal(''))

Assertion failure: fun(), at ion/CompileInfo.h

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Oops, wrong bug.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Pastebin patch v2

http://www.pastebin.mozilla.org/2369719 is an updated pastebin patch provided by bhackett to fix the bug in comment 1. (replicated here)

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack for assertion

function f() {}
for (var a = 0; a < 99; a++) {
    f()
}

Assertion failure: script->types, at jsinferinlines.h (Pastebin patch v2 applied on m-i rev 99b086e10c8d, tested on 32-bit debug shell)

This blocks all further fuzzing on jsfunfuzz.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

All requested fuzzing here was finished.