Closed Bug 470618 Opened 16 years ago Closed 16 years ago

TM: "Assertion failure: regs.sp - StackBase(fp) >= 2, at ../jsinterp.cpp"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: gkw, Unassigned)

Details

(Keywords: assertion, crash, testcase) 

for (var z = 0; z < 2; ++z) { with({window: (-this)})true; }

asserts dbg at Assertion failure: regs.sp - StackBase(fp) >= 2, at ../jsinterp.cpp:6073 and crashes opt at js_Interpret near null. TM-only.

===

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000088
Crashed Thread:  0

Thread 0 Crashed:
0   js-opt-tm-intelmac            	0x00031d37 js_Interpret + 12247
1   js-opt-tm-intelmac            	0x0003b94f js_Execute + 559
2   js-opt-tm-intelmac            	0x0000959e JS_ExecuteScript + 60
3   js-opt-tm-intelmac            	0x00002dd0 Process(JSContext*, JSObject*, char*, int) + 1032
4   js-opt-tm-intelmac            	0x00006938 main + 2310
5   js-opt-tm-intelmac            	0x0000221b _start + 209
6   js-opt-tm-intelmac            	0x00002149 start + 41
Flags: blocking1.9.1?
See bug 470619 for a similar assertion.
Any way to trigger this in the shell?
(In reply to comment #2)
> Any way to trigger this in the shell?

Just run |./js -j| then input:

for (var z = 0; z < 2; ++z) { with({window: (-this)})true; }

at the js> command prompt then press enter?
WFM on TM tip.
Status: NEW → RESOLVED
Closed: 16 years ago
Flags: blocking1.9.1? → in-testsuite?
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.