922118 - Assertion failure: !vp.isMagic(), at jsobj.cpp:4030

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 8f805d3ef377 (run with --fuzzing-safe --ion-eager):


var lfcode = new Array();
lfcode.push("1");
lfcode.push("");
lfcode.push("0");
lfcode.push("function arguments() { };");
lfcode.push("1");
lfcode.push("\
var GLOBAL_PROPERTIES = new Array();\
var i = 0;\
for ( p in this ) {\
  GLOBAL_PROPERTIES[i++] = p;\
  for ( i = 0; i < GLOBAL_PROPERTIES.length; i++ ) {\
      eval(GLOBAL_PROPERTIES[i]) \
  }\
}\
");
while (true) {
	var file = lfcode.shift(); if (file == undefined) { break; }
        loadFile(file)
}
function loadFile(lfVarx) {
        if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) {
            switch (lfRunTypeId) {
                case 0: evaluate(lfVarx); break;
                case 1: eval(lfVarx); break;
            }
        } else if (!isNaN(lfVarx)) {
            lfRunTypeId = parseInt(lfVarx);
    }
}

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Let's see if JSBugMon works on this...

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/aca02ab3f2d3
user:        Jan de Mooij
date:        Thu Sep 12 11:14:20 2013 +0200
summary:     Bug 914341 - Fix BC to wrap primitive |this| in eval scripts. r=djvj

This iteration took 383.822 seconds to run.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jan, is bug 914341 a likely regressor?

Comment 5

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] (still catching up on bugmail) from comment #4)
> Jan, is bug 914341 a likely regressor?

No it's not. I can see how that bug may confuse JSBugMon but this is an arguments-object issue. Investigating...

Comment 6

[Jan de Mooij [:jandem]]

Regression from bug 743394.

Comment 7

[Jan de Mooij [:jandem]]

Attachment: Patch

Ion checks whether the eval string has "arguments" in it but it should also check for "eval" because an inner eval can contain "arguments".

Comment 9

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/979ff52f1482

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/979ff52f1482