"Assertion failure: obj != iterobj, at ../jsiter.cpp" with Iterator

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
8 years ago
5 years ago

People

(Reporter: gkw, Assigned: gal)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 final+)

Details

(Whiteboard: fixed-in-tracemonkey)

(Reporter)

Description

8 years ago
x = Iterator([])
for (z in x) {}
(function() {
    for (l in function() {}) {}
} ())
for (z in x) {}

asserts js debug shell on TM tip without -j at Assertion failure: obj != iterobj, at ../jsiter.cpp:192

Found via compareJIT part of jsfunfuzz.
(Reporter)

Comment 1

8 years ago
autoBisect shows this is probably related to bug 558058:

The first bad revision is:
changeset:   40464:36b0db8dc22f
user:        Andreas Gal
date:        Thu Apr 08 10:55:58 2010 -0700
summary:     No need to lookup parent/proto for iteration objects used for enumeration, and cache the last free iteration object for re-use (558058, r=brendan).
Blocks: 558058
(Reporter)

Updated

8 years ago
Summary: "Assertion failure: obj != iterobj, at ../jsiter.cpp" → "Assertion failure: obj != iterobj, at ../jsiter.cpp" with Iterator
(Assignee)

Updated

8 years ago
Assignee: general → gal
(Assignee)

Comment 2

8 years ago
My new iterator code does not crash here. I will grab the bug and WFM when the patch lands. It should block beta though to make sure this doesn't get forgotten. This is not in any of our products.
blocking2.0: --- → ?
(Reporter)

Comment 3

8 years ago
Confirming fixed by bug 558754.
Whiteboard: fixed-in-tracemonkey

Updated

8 years ago
blocking2.0: ? → final+
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.