920446 - Assertion failure: analyzedArgsUsage(), at ../jsscript.h:691

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 68d279364a8b (run with --fuzzing-safe):


var g = newGlobal();
var dbg = new Debugger(g);
dbg.onNewScript = function(script) {
    fscript = script.getChildScripts()[0];
}
g.eval("function f(x) { arguments[0] = 3; return x }");
fscript.setBreakpoint(0, {hit:function(frame) {
    assertEq(frame.eval(("1null")).return, 1);
}});
assertEq(g.f(1), 42);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/4370f503d69f
user:        Brian Hackett
date:        Thu May 23 13:25:19 2013 -0600
summary:     Bug 875276 - Don't profile types in scripts until they are compiled by baseline, r=jandem.

This iteration took 1.104 seconds to run.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, is bug 875276 a likely regressor?

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

No, this is a preexisting issue.

Comment 5

[Luke Wagner [:luke]]

Comment on attachment 813529 [details] [diff] [review]
patch

Not a preexisting issue, though: before bug 875276, the script would have been analyzed before execution and thus before onPopCall.

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c4f37d077bc7

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/c4f37d077bc7