876226 - Assertion failure: hasfp(), at vm/Stack.h or Assertion failure: !seg_, at vm/Stack.cpp or Assertion failure: space().firstUnused() == seg_->invokeArgsEnd(), at vm/Stack.cpp or Assertion failure: regs_, or Assertion failure: cx->maybeRegs() == &regs_,

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

evaluate("()", {
    saveFrameChain: true
});

asserts js debug shell on m-c changeset 0fed3377c839 without any CLI arguments at Assertion failure: hasfp(), at vm/Stack.h

The simplicity of this testcase is causing it to show up repeatedly in jsfunfuzz.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Error: Failed to isolate test from comment

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack for second assertion

A similar testcase:

evaluate(")", {
    newContext: new Set,
    saveFrameChain: true
});

causes Assertion failure: !seg_, at vm/Stack.cpp

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Run the testcase in comment 0 with --baseline-eager --no-ti --no-ion and you will get yet another assert: Assertion failure: space().firstUnused() == seg_->invokeArgsEnd(), at vm/Stack.cpp

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   132897:e00506a9478f
user:        Jan de Mooij
date:        Fri May 24 14:03:36 2013 +0200
summary:     Bug 875473 - Add saveFrameChain option to shell evaluate function. r=luke

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    evaluate("(7)(1)", {
        catchTermination: x = 1,
        saveFrameChain: true
    })
})()

Assertion failure: regs_, at vm/Stack.h

evaluate("(7)(1)", {
    catchTermination: x = 1,
    saveFrameChain: true
})

Assertion failure: cx->maybeRegs() == &regs_, at jscntxtinlines.h

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

evaluate("u", {
    catchTermination: (/x/ != 4),
    saveFrameChain: true
})
this.a

Crash [@ js::PropertyCache::fullTest] when passed in as a CLI argument.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

s = newGlobal('')
try {
    evalcx("\
           Object.defineProperty(this, \"v1\", {\
                get: function() {\
                    return evaluate(\")\", {\
                        saveFrameChain: x\
                    })\
                }\
            });\
            ((x) =__defineGetter__(\"\", (function() {})))\
            (uneval(v1))\
           ", s)
} catch (e) {}
evalcx("\
    (x=[]);\
    for(v of v1) {}\
", s)

Assertion failure: cx->compartment == oldCompartment, at jscompartment.h

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

evalcx("\
    let z = 0;\
    z += 'x';\
    for (var v of z) {\
        y = evaluate(\"Object.defineProperty(this,\\\"y\\\",{ \
                            get:  function() {} \
                        } );\", { \
                            catchTermination: true,\
                            saveFrameChain: true\
                        }\
                    );\
        }",
    newGlobal('')
)

Assertion failure: scope == cx->global(), at jsinterpinlines.h

Comment 9

[Jan de Mooij [:jandem]]

Attachment: Patch

Shell-only problem. We have to restore the frame chain if the evaluate function fails. The patch adds a RAII class to do this.

Comment 10

[Jan de Mooij [:jandem]]

Attachment: Patch

Comment 11

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 12

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2cac52a99419

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/2cac52a99419