Assertion failure with "constructor=({});"

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
P1
major
RESOLVED WORKSFORME
10 years ago
10 years ago

People

(Reporter: Jesse Ruderman, Assigned: brendan)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla1.9beta5
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

10 years ago
js> (function(){(function(){ constructor=({}); })()})()
Assertion failure: entry->kpc == ((PCVCAP_TAG(entry->vcap) > 1) ? (jsbytecode *) JSID_TO_ATOM(id) : cx->fp->regs->pc), at jsobj.c:3477

jsfunfuzz hits this about once a minute :(

This is the same assertion failure as in bug 416834, but the testcases seem completely different, and I think this is a much more recent regression.
(Assignee)

Comment 1

10 years ago
This could have been regressed by the patch for bug 418989, which was good by itself but exposed the latent bug, namely that the assertion is bogus. But there may be more to it than this. Jesse, can you track down the regression window?

/be
Assignee: general → brendan
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9beta5
(Reporter)

Comment 2

10 years ago
Yes, this is a regression from bug 418989 (verified using checkout-by-date).

Is it bogus in bug 416834 too, or is something actually going wrong there?
Blocks: 418989
(Reporter)

Comment 3

10 years ago
WFM on trunk.
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Flags: in-testsuite?
Resolution: --- → WORKSFORME

Comment 4

10 years ago
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-424311.js,v  <--  regress-424311.js
initial revision: 1.1
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.