877333 - Assertion failure: (ptrBits & 0x7) == 0, at ./dist/include/js/Value.h:703 or Crash [@ ToPrimitive] with controllable invalid read involving rest arguments

Status: RESOLVED DUPLICATE of bug 875957

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision e58336e81395 (run with --ion-eager):


var x = [];
var n = [];
var np = 0xbeef;
function mont_(... y) {
  for (j=1 ; j<y.length; j++)
	undefined * y[j];
}
mont_(x, n, np);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Crashes near 0xbeef, so marking s-s. djvj mentioned this could be a dup of one of the other bugs that crash similarly, but he wasn't sure so we decided to file and track this as the other bugs get fixed.

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   132612:b2216a10f95b
user:        Shu-yu Guo
date:        Tue May 21 23:52:45 2013 -0700
summary:     Bug 867471 - Part 2: Compile rest parameter in Ion for sequential execution. (r=djvj)

This iteration took 0.949 seconds to run.

Comment 4

[Kannan Vijayan [:djvj]]

This is probably a dup of 875957.  Confirming.