Closed Bug 459630 Opened 13 years ago Closed 13 years ago

TM: "Assertion failure: JSVAL_TAG(v) == JSVAL_STRING"

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect

Tracking

()

Status:
VERIFIED WORKSFORME

People

(Reporter: jruderman, Assigned: gal)

References

Details

(Keywords: assertion, testcase) 

(function(){ [].__proto__.u = void 0; for (let y in [5,6,7,8]) y = NaN; })()

Assertion failure: JSVAL_TAG(v) == JSVAL_STRING, at jstracer.cpp:1334
same assertion, essentially same test in js1_7/regress/regress-452703.js

regressed by http://hg.mozilla.org/mozilla-central/rev/186b4ce768ec (bug 459537).
Blocks: 459537
Thanks for bisecting.
Assignee: general → gal
Status: NEW → RESOLVED
Closed: 13 years ago
Priority: -- → P1
Resolution: --- → FIXED
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Duplicate of this bug: 460980
Still crashing.  "let" is not the culprit:

for(y in [0,1,2]) y = NaN;
Assertion failure: JSVAL_TAG(v) == JSVAL_STRING, at jstracer.cpp:1334
Added test-case.

http://hg.mozilla.org/tracemonkey/rev/d40d1098f7aa
Status: REOPENED → RESOLVED
Closed: 13 years ago → 13 years ago
Resolution: --- → WORKSFORME
I think you should add these to the bottom of the test function, so the test doesn't pollute the global namespace and [].__proto__.

delete [].__proto__.u;
delete y;
I found another testcase that still triggers this assertion.  See bug 461590.
v 1.9.1
Status: RESOLVED → VERIFIED
Flags: in-testsuite?
Flags: in-litmus-
added to js1_8_1/trace/trace-test.js
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.