Closed Bug 477048 Opened 11 years ago Closed 11 years ago

"Assertion failure: cg->stackDepth == loopDepth, at ../jsemit.cpp"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: gkw, Assigned: jorendorff)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, verified1.9.1, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

for each (this.__proto__ in x) {}
Assertion failure: cg->stackDepth == loopDepth, at ../jsemit.cpp:4433
Trace/BPT trap

asserts debug (TM not needed) but seems to work as expected in opt. Related to bug 467495?

Nominating blocking-1.9.1 in case it is a regression from bug 467495, which is a P1 critical trunk bug.
Flags: blocking1.9.1?
(In reply to comment #0)
> Nominating blocking-1.9.1 in case it is a regression from bug 467495, which is
> a P1 critical trunk bug.

... and also because jsfunfuzz is hitting it very very frequently due to simplicity.
Taking.
Assignee: general → jorendorff
Attached patch v1Splinter Review
Fallout from bug 469625.

This fixes the specific test case in the description. There are five calls to EmitPropOp in jsemit.cpp, need to check that none of them trip the assertion.
Attachment #360751 - Flags: review?(brendan)
Comment on attachment 360751 [details] [diff] [review]
v1

Bad reviewer (me). Just a few lines more context would show the requirements. Thanks,

/be
Attachment #360751 - Flags: review?(brendan) → review+
I checked, and FORPROP was the only opcode tripping the assertion there.  Pushed.

http://hg.mozilla.org/tracemonkey/rev/dc636df847be
Whiteboard: fixed-in-tracemonkey
Flags: blocking1.9.1? → blocking1.9.1+
http://hg.mozilla.org/mozilla-central/rev/dc636df847be
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
http://hg.mozilla.org/mozilla-central/rev/7b238852cf5d
Flags: in-testsuite+
Flags: in-litmus-
js1_7/extensions/regress-477048.js
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.