[Webkit-unassigned] [Bug 144293] New: FTL failed to initialize arguments.callee

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=144293

            Bug ID: 144293
           Summary: FTL failed to initialize arguments.callee
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.lam at apple.com

Here's the test case:

=== BEGIN ===
function foo(e) {
    if (e) {
        arguments[0]--;
        return arguments.callee.apply(this, arguments);
    }
}

try {
    for (var i = 0; i < 10000; i++)
        foo(1);
} catch (e) {
    print("ERROR: " + e);
}
=== END ===

Run it in a debug build of jsc like so:
$ JSC_enableConcurrentJIT=0 DYLD_FRAMEWORK_PATH=WebKitBuild/Debug/ WebKitBuild/Debug/jsc test.js

And you'll get this crash trace:

(lldb) bt
* thread #1: tid = 0x61fc1a, 0x0000000100a80cda JavaScriptCore`WTFCrash + 42 at Assertions.cpp:321, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xbbadbeef)
    frame #0: 0x0000000100a80cda JavaScriptCore`WTFCrash + 42 at Assertions.cpp:321
  * frame #1: 0x000000010069dd3b JavaScriptCore`JSC::PropertySlot::setValue(this=0x00007fff5fbfdd78, slotBase=0x0000000104250500, attributes=4, value=JSValue at 0x00007fff5fbfdaa8) + 91 at PropertySlot.h:127
    frame #2: 0x00000001006e430e JavaScriptCore`JSC::GenericArguments<JSC::DirectArguments>::getOwnPropertySlot(object=0x0000000104250500, exec=0x00007fff5fbfde80, ident=PropertyName at 0x00007fff5fbfdb90, slot=0x00007fff5fbfdd78) + 334 at GenericArgumentsInlines.h:46
    frame #3: 0x000000010009ee67 JavaScriptCore`JSC::JSObject::fastGetOwnPropertySlot(this=0x0000000104250500, exec=0x00007fff5fbfde80, vm=0x0000000104010000, structure=0x0000000104034db0, propertyName=PropertyName at 0x00007fff5fbfdbf0, slot=0x00007fff5fbfdd78) + 167 at JSObject.h:1257
    frame #4: 0x000000010009ebdc JavaScriptCore`JSC::JSObject::getPropertySlot(this=0x0000000104250500, exec=0x00007fff5fbfde80, propertyName=PropertyName at 0x00007fff5fbfdca0, slot=0x00007fff5fbfdd78) + 156 at JSObject.h:1269
    frame #5: 0x00000001000a21a8 JavaScriptCore`JSC::JSValue::getPropertySlot(this=0x00007fff5fbfddb0, exec=0x00007fff5fbfde80, propertyName=PropertyName at 0x00007fff5fbfdd00, slot=0x00007fff5fbfdd78) const + 232 at JSCJSValueInlines.h:719
    frame #6: 0x000000010067adb2 JavaScriptCore`operationGetByIdOptimize(exec=0x00007fff5fbfde80, stubInfo=0x0000000105fed4b0, base=4364502272, uid=0x0000000105ff3a40) + 162 at JITOperations.cpp:188
    frame #7: 0x00003242ffa035c0
    frame #8: 0x00003242ffa02529