963077 - Assertion failure: hasScript(), at c:\users\mozilla\debug-builds\mozilla-central\js\src\jsfun.h:337

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

found via bughunter

steps to reproduce:

-> Trunk Debug Build from m-c tip on win7
-> Load http://www.bitdefender.co.uk/solutions/total-security.html
--> Assertion failure after a few seconds

working on a regression range and testcase

Comment 1

[Till Schneidereit [:till]]

(In reply to Carsten Book [:Tomcat] from comment #0)
> working on a regression range and testcase

This almost certainly is caused by bug 886193. I'm looking into it (though I can't currently reproduce), but I don't think it's necessarily sec-critical.

Comment 2

[Till Schneidereit [:till]]

I just rebuilt, and can't reproduce at all. I'm on OS X, though. Reliable STR would be great.

Comment 3

[Carsten Book [:Tomcat]]

Attachment: windows stack

Comment 4

[Carsten Book [:Tomcat]]

Attachment: linux crash stack

Comment 5

[Carsten Book [:Tomcat]]

(In reply to Till Schneidereit [:till] from comment #2)
> I just rebuilt, and can't reproduce at all. I'm on OS X, though. Reliable
> STR would be great.

hm seems according to bughunter that this happens on linux and windows but also no results/crashes for mac OS X so far and steps to reproduce from comment #0 still works, only that i had to reload the site sometimes to crash

Comment 6

[Till Schneidereit [:till]]

Ok, I'll try reproducing on Linux, then. Thanks for the further info.

Comment 7

[Till Schneidereit [:till]]

And of course I can't reproduce on Linux (Fedora 19 64bit), either

Comment 8

[Till Schneidereit [:till]]

Attachment: ensure function is non-lazy before getting its arguments in js_fun_apply.

Turns out js_fun_apply uses the callee before Invoke is called and ensures that the function is delazified. This fixes that, and, judging by the stack traces, should also fix the crashes.

Comment 9

[Jan de Mooij [:jandem]]

Comment on attachment 8365091 [details] [diff] [review]
ensure function is non-lazy before getting its arguments in js_fun_apply.

Review of attachment 8365091 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch.

Comment 10

[Till Schneidereit [:till]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/9a565e0bd847

Jandem, thanks for the quick review; Tomcat, thanks for the stack traces and analysis. I didn't manage to reproduce the problem, but the stack traces gave me enough information in the end.

Comment 11

[Till Schneidereit [:till]]

Bustage follow-up:
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/d319f9ddf227

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9a565e0bd847
https://hg.mozilla.org/mozilla-central/rev/d319f9ddf227