Closed
Bug 561279
Opened 14 years ago
Closed 14 years ago
TM: "Assertion failure: obj->getPrivate() == fp, at ../jstracer.cpp" or "Assertion failure: obj->getPrivate() == js_FloatingFrameIfGenerator(cx, fp), at ../jstracer.cpp"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
People
(Reporter: gkw, Assigned: mrbkap)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
1.41 KB,
patch
|
jorendorff
:
review+
|
Details | Diff | Splinter Review |
for (let y in eval("\ for (z = 0; z < 6; z++) {\ a = z\ }\ "))(y) asserts js debug shell on TM tip with -j at Assertion failure: obj->getPrivate() == fp, at ../jstracer.cpp:13732 Found via the compareJIT part of jsfunfuzz.
Reporter | ||
Comment 1•14 years ago
|
||
autoBisect shows this is probably related to bug 469237: The first bad revision is: changeset: 27482:ca40d9bb0954 user: jimb date: Tue Apr 21 22:42:43 2009 -0700 summary: Bug 469237: Only trace where BINDNAME will choose the global object.
Blocks: 469237
Reporter | ||
Comment 2•14 years ago
|
||
This affects 1.9.1, 1.9.2 and TM tip js shells. Nominating to get it on the radar.
blocking1.9.1: --- → ?
blocking1.9.2: --- → ?
blocking2.0: --- → ?
Updated•14 years ago
|
Assignee: general → jorendorff
Comment 3•14 years ago
|
||
Wanted, not blocking if it's only in a debug shell.
Assignee | ||
Comment 4•14 years ago
|
||
As far as I can tell, this is a bug in the assertion: it assumes that there can only be one frame for a toplevel script. But eval and debugger frames defeat this assumption. The values are still on the stack, so this just widens the assertion.
Comment 5•14 years ago
|
||
Comment on attachment 444198 [details] [diff] [review] Proposed fix That needs to be a while loop instead of an if, because... { let y; eval('eval("for (z = 0; z < 6; z++) a = z;")'); } And this needs tests. r+ with those changes.
Attachment #444198 -
Flags: review?(jorendorff) → review+
Reporter | ||
Comment 6•14 years ago
|
||
This has now morphed into the following assertion: Assertion failure: obj->getPrivate() == js_FloatingFrameIfGenerator(cx, fp), at ../jstracer.cpp:13885
Summary: TM: "Assertion failure: obj->getPrivate() == fp, at ../jstracer.cpp" → TM: "Assertion failure: obj->getPrivate() == fp, at ../jstracer.cpp" or "Assertion failure: obj->getPrivate() == js_FloatingFrameIfGenerator(cx, fp), at ../jstracer.cpp"
Updated•14 years ago
|
blocking2.0: ? → beta1+
Assignee | ||
Comment 8•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/769cce825017
Whiteboard: fixed-in-tracemonkey
Assignee | ||
Comment 9•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/74e8869eb66a
Flags: in-testsuite+
Comment 10•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/769cce825017
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 11•12 years ago
|
||
A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.
Status: RESOLVED → VERIFIED
You need to log in
before you can comment on or make changes to this bug.
Description
•