882933 - Assertion failure: script->treatAsRunOnce, at vm/Interpreter.cpp

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(s=>7)()

asserts js debug shell on m-c changeset b197bed90a98 with --no-ti at Assertion failure: script->treatAsRunOnce, at vm/Interpreter.cpp

(This still reproduces on tip on mozilla-inbound)

This is blowing up jsfunfuzz :-/

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/0a5f190b9f9b
user:        Brian Hackett
date:        Fri May 31 16:22:34 2013 -0600
summary:     Bug 864218 - Improve performance when accessing variables defined in run-once closures, r=luke,jandem.

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

Cloning a script doesn't preserve the treatAsRunOnce bit on the script, though not doing so won't really lead to anything bad later, except maybe some unnecessary deoptimization.  The arrow function's script gets deep cloned whenever the arrow lambda is created, which is pretty bad for perf and is also fixed by this patch.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/07b41e0cded6

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/07b41e0cded6

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I recently had time to migrate the fuzzing harness from ESR 17 to ESR 24. It will be nice to backport this fuzzblocker, thanks!

Comment 6

[Brian Hackett [Laid off!]]

Comment on attachment 766458 [details] [diff] [review]
patch

[Approval Request Comment]
See comment 5

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr24/rev/70cf6a359cb4

Comment 8

[Matt Wobensmith [:mwobensmith][:matt:]]

Gary, can you verify that this was fixed? Thanks.

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Matt Wobensmith from comment #8)
> Gary, can you verify that this was fixed? Thanks.

VERIFIED fixed, tested on rev cafe909f7e07.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

And also verified on esr24 branch rev 206679523c3c.