999655 - [jsdbg2] Assertion failure: analyzedArgsUsage(), at jsscript.h:1146

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision c962bde5ac0b (run with --fuzzing-safe):


var g = newGlobal();
var dbg = new Debugger(g);
dbg.onNewScript = function(script) {
    fscript = script.getChildScripts()[0];
}
g.eval("function f(x) { arguments[0] = 3; return x }");
fscript.setBreakpoint(0, {hit:function(frame) {
    assertEq(frame.arguments[0], (2));
}});
g.f(1);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/4370f503d69f
user:        Brian Hackett
date:        Thu May 23 13:25:19 2013 -0600
summary:     Bug 875276 - Don't profile types in scripts until they are compiled by baseline, r=jandem.

This iteration took 275.807 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Still hitting this, needinfo from Brian based on comment 2.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

I don't think this was caused by bug 875276.  For a while it's been the case that frames don't have arguments objects until JSOP_ARGUMENTS executes, and we don't analyze arguments usage until then either.  So if the debugger inspects a frame's arguments it should make sure the arguments usage has been analyzed.

Comment 5

[Jason Orendorff [:jorendorff]]

Comment on attachment 8501174 [details] [diff] [review]
patch

Review of attachment 8501174 [details] [diff] [review]:
-----------------------------------------------------------------

Impressive that the fuzzer managed to hit this.

I don't know how anyone writing this kind of code was supposed to get this right. It seems pretty hopeless. At least we have an assertion there.

Please take a look at the comment on analyzedArgsUsage() (which says we do the analysis before running the script the first time).

Comment 6

[Brian Hackett [Laid off!]]

Fix, with the comment on analyzedArgsUsage() fixed too:

https://hg.mozilla.org/integration/mozilla-inbound/rev/f7ccff28c96f

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/f7ccff28c96f