Closed Bug 558619 Opened 12 years ago Closed 12 years ago

TM: Crash [@ js_Enumerate] or "Assertion failure: JSVAL_IS_INT(v), at ../jsapi.h" with Iterator

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: gkw, Assigned: brendan)

References

Details

(4 keywords, Whiteboard: fixed-in-tracemonkey)

Crash Data

Attachments

(1 file)

fix
935 bytes, patch
dvander
: review+
Details | Diff | Splinter Review 
eval("new Iterator")


(pass this as a CLI argument to assert/crash)

asserts js debug shell on TM tip without -j at Assertion failure: JSVAL_IS_INT(v), at ../jsapi.h:242 and crashes js opt shell without -j at js_Enumerate

Tested on 64-bit Linux. autoBisecting soon...
Actually, this is enough:

new Iterator


(eval isn't needed)
autoBisect shows this is probably related to bug 557914:

The first bad revision is:
changeset:   40655:121debb9ff3d
user:        Andreas Gal
date:        Sat Apr 10 16:08:14 2010 -0700
summary:     Remove gcIteratorTable (557914, r=brendan).
Blocks: 557914
Due to simplicity, this affects jsfunfuzz quite a bit..
Summary: TM: Crash [@ js_Enumerate] or "Assertion failure: JSVAL_IS_INT(v), at ../jsapi.h" → TM: Crash [@ js_Enumerate] or "Assertion failure: JSVAL_IS_INT(v), at ../jsapi.h" with Iterator
Attached patch fix — — Splinter Review 
Why didn't this used to happen? Simple: we wouldn't js_RegisterCloseableIterator until InitNativeIterator, after js_ValueToNonNullObject(cx, argv[0]) succeeded. If the last failed, we'd never register.

Now with Andreas's patch, just creating a new Iterator instance makes an object of GC-finalize-kind FINALIZE_ITER, and we will inevitably CloseNativeIterator it.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #438315 - Flags: review?(dvander)
Attachment #438315 - Flags: review?(dvander) → review+
http://hg.mozilla.org/tracemonkey/rev/4932aaad4962

/be
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/4932aaad4962
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Crash Signature: [@ js_Enumerate]
You need to log in before you can comment on or make changes to this bug.