Assertion failure: !vp.isMagic(), at jsobj.cpp:4030

RESOLVED FIXED in mozilla27

Status

()

--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla27
x86
Linux
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
The following testcase asserts on mozilla-central revision 8f805d3ef377 (run with --fuzzing-safe --ion-eager):


var lfcode = new Array();
lfcode.push("1");
lfcode.push("");
lfcode.push("0");
lfcode.push("function arguments() { };");
lfcode.push("1");
lfcode.push("\
var GLOBAL_PROPERTIES = new Array();\
var i = 0;\
for ( p in this ) {\
  GLOBAL_PROPERTIES[i++] = p;\
  for ( i = 0; i < GLOBAL_PROPERTIES.length; i++ ) {\
      eval(GLOBAL_PROPERTIES[i]) \
  }\
}\
");
while (true) {
	var file = lfcode.shift(); if (file == undefined) { break; }
        loadFile(file)
}
function loadFile(lfVarx) {
        if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) {
            switch (lfRunTypeId) {
                case 0: evaluate(lfVarx); break;
                case 1: eval(lfVarx); break;
            }
        } else if (!isNaN(lfVarx)) {
            lfRunTypeId = parseInt(lfVarx);
    }
}
(Reporter)

Comment 1

5 years ago
Created attachment 812045 [details]
[crash-signature] Machine-readable crash signature
Let's see if JSBugMon works on this...
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 3

5 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/aca02ab3f2d3
user:        Jan de Mooij
date:        Thu Sep 12 11:14:20 2013 +0200
summary:     Bug 914341 - Fix BC to wrap primitive |this| in eval scripts. r=djvj

This iteration took 383.822 seconds to run.
Jan, is bug 914341 a likely regressor?
Blocks: 914341
Flags: needinfo?(jdemooij)
Keywords: regression
(Assignee)

Comment 5

5 years ago
(In reply to Gary Kwong [:gkw] [:nth10sd] (still catching up on bugmail) from comment #4)
> Jan, is bug 914341 a likely regressor?

No it's not. I can see how that bug may confuse JSBugMon but this is an arguments-object issue. Investigating...
No longer blocks: 914341
(Assignee)

Updated

5 years ago
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Component: JavaScript Engine → JavaScript Engine: JIT
Flags: needinfo?(jdemooij)
(Assignee)

Comment 6

5 years ago
Regression from bug 743394.
Blocks: 743394
(Assignee)

Comment 7

5 years ago
Created attachment 815005 [details] [diff] [review]
Patch

Ion checks whether the eval string has "arguments" in it but it should also check for "eval" because an inner eval can contain "arguments".
Attachment #815005 - Flags: review?(bhackett1024)
(Assignee)

Updated

5 years ago
Duplicate of this bug: 882170
Attachment #815005 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/979ff52f1482
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
You need to log in before you can comment on or make changes to this bug.