Closed Bug 561278 Opened 14 years ago Closed 14 years ago

"Assertion failure: obj != iterobj, at ../jsiter.cpp" with Iterator

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
blocking2.0 --- final+

People

(Reporter: gkw, Assigned: gal)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey) 

x = Iterator([])
for (z in x) {}
(function() {
    for (l in function() {}) {}
} ())
for (z in x) {}

asserts js debug shell on TM tip without -j at Assertion failure: obj != iterobj, at ../jsiter.cpp:192

Found via compareJIT part of jsfunfuzz.
autoBisect shows this is probably related to bug 558058:

The first bad revision is:
changeset:   40464:36b0db8dc22f
user:        Andreas Gal
date:        Thu Apr 08 10:55:58 2010 -0700
summary:     No need to lookup parent/proto for iteration objects used for enumeration, and cache the last free iteration object for re-use (558058, r=brendan).
Blocks: 558058
Summary: "Assertion failure: obj != iterobj, at ../jsiter.cpp" → "Assertion failure: obj != iterobj, at ../jsiter.cpp" with Iterator
Assignee: general → gal
My new iterator code does not crash here. I will grab the bug and WFM when the patch lands. It should block beta though to make sure this doesn't get forgotten. This is not in any of our products.
blocking2.0: --- → ?
Confirming fixed by bug 558754.
Whiteboard: fixed-in-tracemonkey
blocking2.0: ? → final+
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.