776188 - "Assertion failure: regs->fp() == regs_->fp()->prev(),"

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-06-28-mozilla-central-debug/jsshell-mac64.zip

asserts js debug shell with upcoming testcase with -m and -n at Assertion failure: regs->fp() == regs_->fp()->prev(),

Doesn't occur before 2012-06-28 so unlikely to be bug 728191.

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-06-27-mozilla-central-debug/jsshell-mac64.zip

does not assert.

Regression window points to http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5cdbeae14405&tochange=bf8f2961d0cc

JavaScript changesets were by Steve Fink and Bill McCloskey, so cc'ing them.

s-s because this only occurs on tinderbox js shells and the testcase is very resistant to reduction.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Still occurs with http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-07-20-mozilla-central-debug/jsshell-mac64.zip

Comment 3

[Daniel Veditz [:dveditz]]

how bad a security problem does this assertion represent?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Gary Kwong [:gkw, :nth10sd] from comment #2)
> Still occurs with
> http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-07-20-mozilla-
> central-debug/jsshell-mac64.zip

After some digging, here's a piece of good news:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-08-09-mozilla-central-debug/jsshell-mac64.zip

does not assert.

I'll try to get a fix window.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Fix window:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3a05d298599e&tochange=045c11dd41a6

(opening up as well, since there's nothing more s-s here)