[Webkit-unassigned] [Bug 126070] New: ASSERTION FAILED: dst != localReg in JSC::PostfixNode::emitResolve
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Dec 20 09:17:41 PST 2013
https://bugs.webkit.org/show_bug.cgi?id=126070
Summary: ASSERTION FAILED: dst != localReg in
JSC::PostfixNode::emitResolve
Product: WebKit
Version: 528+ (Nightly build)
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: reni at webkit.org
Blocks: 116980
Created an attachment (id=219763)
--> (https://bugs.webkit.org/attachment.cgi?id=219763&action=review)
Test case
Assertion failure happens if we try to change a const value in the right-hand side of an assignment:
function function_0() {
const foo;
var var_0 = foo++;
with(Object)
switch (var_0) {}
}
function_0();
Backtrace:
ASSERTION FAILED: dst != localReg
/home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp(683) : virtual JSC::RegisterID* JSC::PostfixNode::emitResolve(JSC::BytecodeGenerator&, JSC::RegisterID*)
1 0x7ffff74e57b8 WTFCrash
2 0x7ffff708e963 JSC::PostfixNode::emitResolve(JSC::BytecodeGenerator&, JSC::RegisterID*)
3 0x7ffff708f239 JSC::PostfixNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
4 0x7ffff7065802 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::ExpressionNode*)
5 0x7ffff705dffb JSC::BytecodeGenerator::emitNewArray(JSC::RegisterID*, JSC::ElementNode*, unsigned int)
6 0x7ffff708a65a JSC::ArrayNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
7 0x7ffff7065802 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::ExpressionNode*)
8 0x7ffff7093cc2 JSC::ConstDeclNode::emitCodeSingle(JSC::BytecodeGenerator&)
9 0x7ffff7093ede JSC::ConstDeclNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
10 0x7ffff7065802 JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::ExpressionNode*)
11 0x7ffff709af81 JSC::BytecodeGenerator::emitNode(JSC::ExpressionNode*)
12 0x7ffff7093f6f JSC::ConstStatementNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
13 0x7ffff70656ba JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::StatementNode*)
14 0x7ffff709b425 JSC::SourceElements::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
15 0x7ffff7093fb4 JSC::BlockNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
16 0x7ffff70656ba JSC::BytecodeGenerator::emitNode(JSC::RegisterID*, JSC::StatementNode*)
17 0x7ffff709b425 JSC::SourceElements::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
18 0x7ffff709b524 JSC::ScopeNode::emitStatementsBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
19 0x7ffff70980c0 JSC::FunctionBodyNode::emitBytecode(JSC::BytecodeGenerator&, JSC::RegisterID*)
20 0x7ffff7056252 JSC::BytecodeGenerator::generate()
21 0x7ffff704d797
22 0x7ffff704e0c4 JSC::UnlinkedFunctionExecutable::codeBlockFor(JSC::VM&, JSC::SourceCode const&, JSC::CodeSpecializationKind, JSC::DebuggerMode, JSC::ProfilerMode, JSC::ParserError&)
23 0x7ffff739a0db JSC::ScriptExecutable::newCodeBlockFor(JSC::CodeSpecializationKind, JSC::JSScope*, JSC::JSObject*&)
24 0x7ffff739a7ad JSC::ScriptExecutable::prepareForExecutionImpl(JSC::ExecState*, JSC::JSScope*, JSC::CodeSpecializationKind)
25 0x7ffff7279f18 JSC::ScriptExecutable::prepareForExecution(JSC::ExecState*, JSC::JSScope*, JSC::CodeSpecializationKind)
26 0x7ffff74ccccf JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*)
27 0x7ffff74cd0fd JSC::LLInt::genericCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind)
28 0x7ffff74c927c
29 0x7ffff74d15b7
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff74e57bd in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:341
341 *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0 0x00007ffff74e57bd in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:341
#1 0x00007ffff708e963 in JSC::PostfixNode::emitResolve (this=0x6711f0, generator=..., dst=0x670d04)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:683
#2 0x00007ffff708f239 in JSC::PostfixNode::emitBytecode (this=0x6711f0, generator=..., dst=0x670d04)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:746
#3 0x00007ffff7065802 in JSC::BytecodeGenerator::emitNode (this=0x674880, dst=0x670d04, n=0x6711f0)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:269
#4 0x00007ffff705dffb in JSC::BytecodeGenerator::emitNewArray (this=0x674880, dst=0x670cf8, elements=0x671248, length=0)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:1567
#5 0x00007ffff708a65a in JSC::ArrayNode::emitBytecode (this=0x671260, generator=..., dst=0x670cf8)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:178
#6 0x00007ffff7065802 in JSC::BytecodeGenerator::emitNode (this=0x674880, dst=0x670cf8, n=0x671260)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:269
#7 0x00007ffff7093cc2 in JSC::ConstDeclNode::emitCodeSingle (this=0x671288, generator=...)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:1492
#8 0x00007ffff7093ede in JSC::ConstDeclNode::emitBytecode (this=0x671288, generator=...)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:1516
#9 0x00007ffff7065802 in JSC::BytecodeGenerator::emitNode (this=0x674880, dst=0x0, n=0x671288)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:269
#10 0x00007ffff709af81 in JSC::BytecodeGenerator::emitNode (this=0x674880, n=0x671288)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:274
#11 0x00007ffff7093f6f in JSC::ConstStatementNode::emitBytecode (this=0x6712b8, generator=...)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:1526
#12 0x00007ffff70656ba in JSC::BytecodeGenerator::emitNode (this=0x674880, dst=0x6748d8, n=0x6712b8)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:253
#13 0x00007ffff709b425 in JSC::SourceElements::emitBytecode (this=0x6711a8, generator=..., dst=0x6748d8)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:1542
#14 0x00007ffff7093fb4 in JSC::BlockNode::emitBytecode (this=0x6713b0, generator=..., dst=0x6748d8)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:1561
#15 0x00007ffff70656ba in JSC::BytecodeGenerator::emitNode (this=0x674880, dst=0x6748d8, n=0x6713b0)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:253
#16 0x00007ffff709b425 in JSC::SourceElements::emitBytecode (this=0x671190, generator=..., dst=0x6748d8)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:1542
#17 0x00007ffff709b524 in JSC::ScopeNode::emitStatementsBytecode (this=0x670b10, generator=..., dst=0x6748d8)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:2245
#18 0x00007ffff70980c0 in JSC::FunctionBodyNode::emitBytecode (this=0x670b10, generator=...)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:2281
#19 0x00007ffff7056252 in JSC::BytecodeGenerator::generate (this=0x674880)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:66
#20 0x00007ffff704d797 in JSC::generateFunctionCodeBlock (vm=..., executable=0x7fffa97eff38, source=..., kind=JSC::CodeForCall,
debuggerMode=JSC::DebuggerOff, profilerMode=JSC::ProfilerOff, error=...)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:66
#21 0x00007ffff704e0c4 in JSC::UnlinkedFunctionExecutable::codeBlockFor (this=0x7fffa97eff38, vm=..., source=..., specializationKind=JSC::CodeForCall,
debuggerMode=JSC::DebuggerOff, profilerMode=JSC::ProfilerOff, error=...)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:167
#22 0x00007ffff739a0db in JSC::ScriptExecutable::newCodeBlockFor (this=0x7fffa97cfe70, kind=JSC::CodeForCall, scope=0x7fffa997f970,
exception=@0x7fffffffc3a8: 0x0) at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/runtime/Executable.cpp:213
#23 0x00007ffff739a7ad in JSC::ScriptExecutable::prepareForExecutionImpl (this=0x7fffa97cfe70, exec=0x7fffa9de8f48, scope=0x7fffa997f970,
kind=JSC::CodeForCall) at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/runtime/Executable.cpp:295
#24 0x00007ffff7279f18 in JSC::ScriptExecutable::prepareForExecution (this=0x7fffa97cfe70, exec=0x7fffa9de8f48, scope=0x7fffa997f970, kind=JSC::CodeForCall)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/runtime/Executable.h:386
#25 0x00007ffff74ccccf in JSC::LLInt::setUpCall (execCallee=0x7fffa9de8f48, pc=0x670838, kind=JSC::CodeForCall, calleeAsValue=..., callLinkInfo=0x657e70)
---Type <return> to continue, or q <return> to quit---
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1046
#26 0x00007ffff74cd0fd in JSC::LLInt::genericCall (exec=0x7fffa9de8f98, pc=0x670838, kind=JSC::CodeForCall)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1093
#27 0x00007ffff74c927c in JSC::LLInt::llint_slow_path_call (exec=0x7fffa9de8f98, pc=0x670838)
at /home/reni/Data/REPOS/webkit_sec/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1099
#28 0x00007ffff74d15b7 in llint_op_call () from /home/reni/Data/REPOS/webkit_sec/WebKitBuild/Debug/lib/libjavascriptcore_efl.so.0
#29 0x00007fffaa6298e0 in ?? ()
#30 0x0000000000651368 in ?? ()
#31 0x0000000000000000 in ?? ()
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list