If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h

RESOLVED FIXED in Firefox 35

Status

()

Core
JavaScript Engine: JIT
--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: gkw, Assigned: shu)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla35
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox35 fixed)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
try {
    let x = ((function f(y) {
        if (y > 0) {
            f(-1)
        }
        x
    })(1))
} catch (e) {}

asserts js debug shell on m-c changeset 16ff803b47a9 with --ion-eager --no-threads at Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h.

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140915155135" and the hash "170ce237e4a0".
The "bad" changeset has the timestamp "20140915164436" and the hash "b7f4709b34c3".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=170ce237e4a0&tochange=b7f4709b34c3

Shu-yu, is bug 1001090 a possible regressor? (Assuming related to the let changes)
Flags: needinfo?(shu)
(Assignee)

Comment 1

3 years ago
Created attachment 8496371 [details] [diff] [review]
Check for uninitialized lexical bindings in FetchName and friends.
Attachment #8496371 - Flags: review?(jdemooij)
(Assignee)

Updated

3 years ago
Flags: needinfo?(shu)
Comment on attachment 8496371 [details] [diff] [review]
Check for uninitialized lexical bindings in FetchName and friends.

Review of attachment 8496371 [details] [diff] [review]:
-----------------------------------------------------------------

Can you add the testcase?
Attachment #8496371 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 3

3 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/992946f2286a
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 835ef55e175e).
(Reporter)

Comment 5

3 years ago
http://hg.mozilla.org/mozilla-central/rev/992946f2286a
Assignee: nobody → shu
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox35: affected → fixed
Resolution: --- → FIXED
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update]
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.