875765 - Assertion failure: index < natoms, at ../jsscript.h:772 or Crash [@ range]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision df526497d949 (run with --ion-eager):


eval("(function() { \
var f = '';\
var flags = new Array(); \
flags[2] = 'm';\
flags[3] = undefined;\
test();\
function test() {\
    for (j in flags)\
      f = flags[j];\
  }\
" + " })();");

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

S-s because this is a dangerous range assertion and it non-deterministically crashes in opt builds.

Comment 3

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 4

[Christian Holler (:decoder)]

This can also lead to heap crashes with random address not covered by the machine-readable signature here.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   132759:b9beff192aa2
user:        Brian Hackett
date:        Thu May 23 05:59:53 2013 -0600
summary:     Bug 864218 - Improve performance when accessing variables defined in run-once closures, r=luke,jandem.

This iteration took 322.733 seconds to run.

Comment 6

[Christian Holler (:decoder)]

Brian, can you take a look based on comment 5? Thanks.

Comment 7

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 7a2f7a45819a).

Comment 8

[Andrew McCreight [:mccr8]]

Looks like it went away when bug 864218 was backed out.

Comment 9

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 10

[Brian Hackett [Laid off!]]

Opening this up since 864218 is no longer in the tree.

Comment 11

[Jan de Mooij [:jandem]]

(Nice, it looks like this bug caused the DoTypeUpdateFallback topcrash, bug 875757.)

Comment 12

[Jan de Mooij [:jandem]]

Fix landed as part of bug 864218.