20863 2008-09-15 15:45:01 -0700 ASSERTION FAILED: addressOffset < instructions.size() in CodeBlock::getHandlerForVPC 2008-09-17 19:57:47 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED P1 Normal --- 1 ggaren webkit-unassigned mjs oliver zwarich oldest_to_newest 91258 0 ggaren 2008-09-15 15:45:01 -0700 ~/Labyrinth/OpenSource/JavaScriptCore/tests/mozilla$ "/Volumes/Big/ggaren/build/Debug/jsc" -s -f ./js1_5/shell.js -f ./js1_5/Regress/regress-96128-n.js BUGNUMBER: 96128 STATUS: Testing that JS infinite recursion protection works ASSERTION FAILED: addressOffset < instructions.size() (/Volumes/Big/ggaren/Labyrinth/OpenSource/JavaScriptCore/VM/CodeBlock.cpp:978 bool JSC::CodeBlock::getHandlerForVPC(const JSC::Instruction*, JSC::Instruction*&, int&)) 91259 1 ggaren 2008-09-15 15:45:30 -0700 Only fails in CTI. 91266 2 zwarich 2008-09-15 16:20:04 -0700 The problem is that exception range info is not being correctly generated, now that op_get_by_id is emitted before op_construct and op_instanceof (in this case it is op_construct). I tried to make a quick fix to avoid the crash, but it doesn't seem to work. I must leave now for a while, so I am unassigning this to myself. 91301 3 23457 zwarich 2008-09-15 19:36:46 -0700 Created attachment 23457 Proposed patch 91303 4 23457 mjs 2008-09-15 19:40:22 -0700 Comment on attachment 23457 Proposed patch r=me 91572 5 zwarich 2008-09-17 19:57:47 -0700 Landed in r36472. 23457 2008-09-15 19:36:46 -0700 2008-09-15 19:40:22 -0700 Proposed patch construct.diff text/plain 1623 zwarich SW5kZXg6IENoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBDaGFuZ2VMb2cJKHJldmlzaW9uIDM2NDcx KQorKysgQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTggQEAKKzIwMDgtMDkt MTUgIENhbWVyb24gWndhcmljaCAgPGN3endhcmljaEB1d2F0ZXJsb28uY2E+CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQnVnIDIwODYzOiBBU1NFUlRJ T04gRkFJTEVEOiBhZGRyZXNzT2Zmc2V0IDwgaW5zdHJ1Y3Rpb25zLnNpemUoKSBpbiBDb2RlQmxv Y2s6OmdldEhhbmRsZXJGb3JWUEMKKyAgICAgICAgPGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD0yMDg2Mz4KKworICAgICAgICByMzY0MjcgY2hhbmdlZCB0aGUgbnVtYmVy IG9mIGFyZ3VtZW50cyB0byBvcF9jb25zdHJ1Y3Qgd2l0aG91dCBjaGFuZ2luZworICAgICAgICB0 aGUgYXJndW1lbnQgaW5kZXggZm9yIHRoZSB2UEMgaW4gdGhlIGNhbGwgdG8gaW5pdGlhbGl6ZUNh bGxGcmFtZSgpIGluCisgICAgICAgIHRoZSBDVEkgY2FzZS4gVGhpcyBjYXVzZWQgYSBKU0MgdGVz dCBmYWlsdXJlLiBDb3JyZWN0aW5nIHRoZSBhcmd1bWVudAorICAgICAgICBpbmRleCBmaXhlcyB0 aGUgdGVzdCBmYWlsdXJlLgorCisgICAgICAgICogVk0vTWFjaGluZS5jcHA6CisgICAgICAgIChK U0M6Ok1hY2hpbmU6OmN0aV9vcF9jb25zdHJ1Y3RfSlNDb25zdHJ1Y3QpOgorCiAyMDA4LTA5LTE1 ICBNYXJrIFJvd2UgIDxtcm93ZUBhcHBsZS5jb20+CiAKICAgICAgICAgRml4IEdDQyA0LjIgYnVp bGQuCkluZGV4OiBWTS9NYWNoaW5lLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBWTS9NYWNoaW5lLmNwcAko cmV2aXNpb24gMzY0NjYpCisrKyBWTS9NYWNoaW5lLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNDQ4 MCw3ICs0NDgwLDcgQEAgdm9pZCogTWFjaGluZTo6Y3RpX29wX2NvbnN0cnVjdF9KU0NvbnN0cgog ICAgIHJbZmlyc3RBcmddID0gbmV3T2JqZWN0OyAvLyAidGhpcyIgdmFsdWUKIAogICAgIFJlZ2lz dGVyKiBjYWxsRnJhbWUgPSByICsgZmlyc3RBcmcgLSBSZWdpc3RlckZpbGU6OkNhbGxGcmFtZUhl YWRlclNpemU7Ci0gICAgbWFjaGluZS0+aW5pdGlhbGl6ZUNhbGxGcmFtZShjYWxsRnJhbWUsIGNv ZGVCbG9jaywgQVJHX2luc3RyNCwgc2NvcGVDaGFpbiwgciwgMC8qZHN0Ki8sIGZpcnN0QXJnLCBh cmdDb3VudCwgY29uc3RydWN0b3IpOworICAgIG1hY2hpbmUtPmluaXRpYWxpemVDYWxsRnJhbWUo Y2FsbEZyYW1lLCBjb2RlQmxvY2ssIEFSR19pbnN0cjUsIHNjb3BlQ2hhaW4sIHIsIDAvKmRzdCov LCBmaXJzdEFyZywgYXJnQ291bnQsIGNvbnN0cnVjdG9yKTsKICAgICBleGVjLT5tX2NhbGxGcmFt ZSA9IGNhbGxGcmFtZTsKIAogICAgIHIgPSBzbGlkZVJlZ2lzdGVyV2luZG93Rm9yQ2FsbChleGVj LCBuZXdDb2RlQmxvY2ssIHJlZ2lzdGVyRmlsZSwgcmVnaXN0ZXJCYXNlLCByLCBmaXJzdEFyZywg YXJnQ291bnQsIGV4Y2VwdGlvblZhbHVlKTsK