Closed Bug 558619 Opened 12 years ago Closed 12 years ago
TM: Crash [@ js
_Enumerate] or "Assertion failure: JSVAL _IS _INT(v), at ../jsapi .h" with Iterator
eval("new Iterator") (pass this as a CLI argument to assert/crash) asserts js debug shell on TM tip without -j at Assertion failure: JSVAL_IS_INT(v), at ../jsapi.h:242 and crashes js opt shell without -j at js_Enumerate Tested on 64-bit Linux. autoBisecting soon...
Actually, this is enough: new Iterator (eval isn't needed)
autoBisect shows this is probably related to bug 557914: The first bad revision is: changeset: 40655:121debb9ff3d user: Andreas Gal date: Sat Apr 10 16:08:14 2010 -0700 summary: Remove gcIteratorTable (557914, r=brendan).
Due to simplicity, this affects jsfunfuzz quite a bit..
Summary: TM: Crash [@ js_Enumerate] or "Assertion failure: JSVAL_IS_INT(v), at ../jsapi.h" → TM: Crash [@ js_Enumerate] or "Assertion failure: JSVAL_IS_INT(v), at ../jsapi.h" with Iterator
Why didn't this used to happen? Simple: we wouldn't js_RegisterCloseableIterator until InitNativeIterator, after js_ValueToNonNullObject(cx, argv) succeeded. If the last failed, we'd never register. Now with Andreas's patch, just creating a new Iterator instance makes an object of GC-finalize-kind FINALIZE_ITER, and we will inevitably CloseNativeIterator it. /be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #438315 - Flags: review?(dvander)
12 years ago
Attachment #438315 - Flags: review?(dvander) → review+
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.