TM: "Assertion failure: v != JSVAL_ERROR_COOKIE, at ../jstracer.cpp" with proto, getter

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
10 years ago
9 years ago

People

(Reporter: gkw, Assigned: jorendorff)

Tracking

(Blocks: 1 bug, {assertion, testcase, verified1.9.1})

Trunk
x86
Linux
assertion, testcase, verified1.9.1
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9.1 +
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

10 years ago
for (iters = 0; iters < 11500; ++iters) {
  for each (let x in ['', '', '']){}
  eval("__proto__.x getter = function(){}");
  var a = uneval;
  delete uneval;
  uneval = a;
  var b = toSource;
  delete toSource;
  toSource = b;
  var c = toString;
  delete toString;
  toString = c;
}

asserts debug TM at Assertion failure: v != JSVAL_ERROR_COOKIE, at ../jstracer.cpp:1586 but seems to work as expected in TM opt by showing a "too much recursion" page (doesn't seem to affect anything without -j either). Nominating blocking1.9.1 because this assertion was recently added and had 2 related bugs fixed, but this still appears.
Flags: blocking1.9.1?
(Assignee)

Comment 1

10 years ago
js1_8/extensions/regress-455973.js hits this same assertion.  I think LeaveTree is pretty busted when builtinStatus==3.
Assignee: general → jorendorff

Comment 2

10 years ago
I wonder why this triggers a "too much recursion" error.
(Assignee)

Comment 3

10 years ago
Created attachment 360951 [details] [diff] [review]
v1
Attachment #360951 - Flags: review?(gal)

Updated

10 years ago
Attachment #360951 - Flags: review?(gal) → review+
(Assignee)

Comment 4

10 years ago
Without the JIT it does not.  It must be a bug.  This should be pushed anyway.
Need a new bug for the too much recursion prob?

/be
(Assignee)

Comment 6

10 years ago
http://hg.mozilla.org/tracemonkey/rev/9cbee49d94e4
Whiteboard: fixed-in-tracemonkey
(Assignee)

Updated

10 years ago
Blocks: 477327
(Assignee)

Comment 7

10 years ago
Filed bug 477327 for the "too much recursion" error.

Updated

10 years ago
Flags: blocking1.9.1? → blocking1.9.1+

Comment 8

10 years ago
http://hg.mozilla.org/mozilla-central/rev/9cbee49d94e4
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED

Comment 9

10 years ago
http://hg.mozilla.org/mozilla-central/rev/bab123dfa97a
Flags: in-testsuite+
Flags: in-litmus-

Comment 11

9 years ago
js1_8/regress/regress-477234.js	
v 1.9.1, 1.9.2 re assertion modulo too much recursion in bug 477327
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.