If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Assertion failure: this->is<T>(), at js/src/jsobj.h:562

RESOLVED FIXED in Firefox 51

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
a year ago
a year ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, jsbugmon, testcase})

Trunk
mozilla51
x86_64
Mac OS X
assertion, jsbugmon, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(firefox51 fixed)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

a year ago
The following testcase crashes on mozilla-central revision 4f72b1d05267 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

// jsfunfuzz-generated
options('strict_mode');
// Adapted from randomly chosen test: js/src/jit-test/tests/debug/RematerializedFrame-retval.js
var m = parseModule("\
    var g = newGlobal();\
    var dbg = new Debugger;\
    setInterruptCallback(function() {\
        dbg.addDebuggee(g);\
        dbg.getNewestFrame();\
        return true;\
    });\
    g.eval(\"(\" + function f() {\
        invokeInterruptCallback(function() {\
            f();\
        });\
    } + \")();\");\
");
m.declarationInstantiation();
m.evaluation();


Backtrace:

0   js-dbg-64-dm-clang-darwin-4f72b1d05267	0x0000000104c862fc js::EnvironmentIter::settle() + 2204 (jsobj.h:562)
1   js-dbg-64-dm-clang-darwin-4f72b1d05267	0x0000000104d23205 js::UnwindAllEnvironmentsInFrame(JSContext*, js::EnvironmentIter&) + 37 (Interpreter.cpp:1060)
2   js-dbg-64-dm-clang-darwin-4f72b1d05267	0x00000001049d462a js::jit::DebugEpilogue(JSContext*, js::jit::BaselineFrame*, unsigned char*, bool) + 186 (BaselineFrame.h:139)
3   js-dbg-64-dm-clang-darwin-4f72b1d05267	0x000000010481aa40 js::jit::HandleException(js::jit::ResumeFromException*) + 4944 (JitFrames.cpp:463)
/snip

For detailed crash information, see attachment.
(Reporter)

Comment 1

a year ago
Created attachment 8786016 [details]
Detailed Crash Information
(Reporter)

Comment 2

a year ago
Due to skipped revisions, the first bad revision could be any of:

changeset:   https://hg.mozilla.org/mozilla-central/rev/cb6fc6d38f8d
user:        Shu-yu Guo
date:        Thu Aug 25 01:28:47 2016 -0700
summary:     Bug 1263355 - Rewrite the frontend: bindings. (r=jorendorff,Waldo)

changeset:   https://hg.mozilla.org/mozilla-central/rev/18bec78f348e
user:        Shu-yu Guo
date:        Thu Aug 25 01:28:47 2016 -0700
summary:     Bug 1263355 - Report memory metrics for Scopes. (r=njn)

Shu-yu, is bug 1263355 a likely regressor?
Blocks: 1263355
Flags: needinfo?(shu)

Comment 3

a year ago
Created attachment 8786112 [details] [diff] [review]
Fix hasInitialEnv computation for RematFrames.
Attachment #8786112 - Flags: review?(jdemooij)

Comment 4

a year ago
Not committing test case because it's too slow.
Flags: needinfo?(shu)
Attachment #8786112 - Flags: review?(jdemooij) → review+

Comment 5

a year ago
Pushed by shu@rfrn.org:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4585f2f66645
Fix hasInitialEnv computation for RematFrames. (r=jandem)

Comment 6

a year ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/4585f2f66645
Status: NEW → RESOLVED
Last Resolved: a year ago
status-firefox51: affected → fixed
Flags: in-testsuite?
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
You need to log in before you can comment on or make changes to this bug.