Assertion failure: OBJ_SCOPE(pobj)->object == pobj, at ../jsinterp.cpp

RESOLVED FIXED

Status

()

Core
JavaScript Engine
P1
critical
RESOLVED FIXED
9 years ago
9 years ago

People

(Reporter: gkw, Assigned: jorendorff)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Linux
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9.2 +
in-testsuite ?

Firefox Tracking Flags

(status1.9.2 beta1-fixed)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
let(x)((function () {
    for (y in [x, x]) with({});
})())

asserts dbg js shell on TM branch without -j at Assertion failure: OBJ_SCOPE(pobj)->object == pobj, at ../jsinterp.cpp:444

autoBisect shows this is probably related to bug 503080 :

The first bad revision is:
changeset:   30378:3915e2d2c748
user:        Jason Orendorff
date:        Tue Jul 21 16:25:11 2009 -0500
summary:     Bug 503080 - Remove prototype-scope-sharing. r=brendan.
Flags: blocking1.9.2?

Updated

9 years ago
Assignee: general → jorendorff

Updated

9 years ago
Flags: blocking1.9.2? → blocking1.9.2+
Priority: -- → P1
(Assignee)

Comment 1

9 years ago
Created attachment 390928 [details] [diff] [review]
v1

The assertion needs to be weakened.

In this case `pobj` is a Block object, so it does actually share a scope. Before this patch, I guess the property was actually found on the Block's prototype.  Now it is found on the Block itself.

I think it would be nice if we could make Block-clones proto-less, but JSOP_LEAVEEXPR uses the proto: 

  if (OBJ_GET_PROTO(cx, obj) == fp->blockChain) {
      ...js_PutBlockObject...
  }
Attachment #390928 - Flags: review?(brendan)
Attachment #390928 - Flags: review?(brendan) → review+
Comment on attachment 390928 [details] [diff] [review]
v1

Generally we don't compare == or != NULL (exception: when left operand is nested assignment expression in loop condition).

Better yet, use JS_ASSERT_IF(OBJ_SCOPE(pobj)->object, OBJ_SCOPE(pobj)->object == pobj);

r=me with that.

/be
i had a js crash while running browser-chrome tests on Windows, applying this patch solved them.
Here is the stack trace
http://mozilla.pastebin.com/m1113c556
ps: the crash was persistent, i was able to reproduce it at every run, same point.
(Assignee)

Comment 5

9 years ago
http://hg.mozilla.org/tracemonkey/rev/09c5ef592b5f
Whiteboard: fixed-in-tracemonkey

Comment 7

9 years ago
http://hg.mozilla.org/mozilla-central/rev/b8cc6ff9d6dc
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
(Reporter)

Updated

9 years ago
Flags: in-testsuite?
Mass change: adding fixed1.9.2 keyword

(This bug was identified as a mozilla1.9.2 blocker which was fixed before the mozilla-1.9.2 repository was branched (August 13th, 2009) as per this query: http://is.gd/2ydcb - if this bug is not actually fixed on mozilla1.9.2, please remove the keyword. Apologies for the bugspam)
Keywords: fixed1.9.2
status1.9.2: --- → beta1-fixed
Keywords: fixed1.9.2
You need to log in before you can comment on or make changes to this bug.