Closed Bug 464403 Opened 16 years ago Closed 16 years ago

TM: "Assertion failure: tm->recorder != NULL" looping over array of prints

Categories

(Core :: JavaScript Engine, defect, P1)

x86
macOS
defect

Tracking

()

VERIFIED FIXED
mozilla1.9.1b2

People

(Reporter: jruderman, Assigned: gal)

References

Details

(Keywords: assertion, testcase, verified1.9.1)

Attachments

(1 file, 1 obsolete file)

print(8);
var u = [print, print, function(){}]
for each (x in u) for (u.e in [1,1,1,1]);

Assertion failure: tm->recorder != NULL, at ../jstracer.cpp:3652

Gary found this with jsfunfuzz, and I helped reduce.
Loading the following URL also triggers the assertion:

http://www.instructables.com/id/Run_Backups_on_any_Wii_Without_a_Modchip/?ALLSTEPS
Assignee: general → gal
Status: NEW → ASSIGNED
Flags: blocking1.9.1?
Priority: -- → P1
Target Milestone: --- → mozilla1.9.1b2
Attached patch patch (obsolete) — Splinter Review
Attachment #348089 - Flags: review?(brendan)
Attachment #348089 - Flags: review?(brendan)
Attachment #348089 - Attachment is obsolete: true
Attachment #348091 - Flags: review?(brendan)
Attachment #348091 - Flags: review?(brendan) → review+
Awesome test case. Thanks Jesse. Fixed in TM. If you concur please close the bug once its synced into mc.

http://hg.mozilla.org/tracemonkey/rev/52536f3066ff
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Link confirmed to work with a TM tip build.
test already in js1_8_1/trace/trace-test.js.
Flags: in-testsuite+
Flags: in-litmus-
Flags: blocking1.9.1? → blocking1.9.1+
Keywords: fixed1.9.1
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
No longer blocks: 471373
Depends on: 471373
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: