Closed Bug 566556 Opened 11 years ago Closed 11 years ago

"Assertion failure: bytes != 0" with defineSetter, watch

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: luke)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

this.__defineSetter__('x', Object.create);
this.watch('x', function() {});
x = 3;

Assertion failure: bytes != 0, at ../jscntxt.h:1941
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   41905:a00078178698
user:        Luke Wagner
date:        Wed Mar 03 17:52:26 2010 -0800
summary:     Bug 540706 - use contiguous buffer for stack frames and slots (r=waldo)
Blocks: 540706
Keywords: regression
OS: Mac OS X → All
Hardware: x86 → All
Attached patch fixSplinter Review
Oh, decompiler.  js_watch_set places a frame for an empty function, with nslots == 0, which, before this patch, (regs.sp == NULL) was catching.  To have fewer corner cases, the contiguous stack patch always keeps regs.sp != NULL (regs.sp == fp->slots() for empty scripts and slow natives), hence the 0-byte malloc.
Assignee: general → lw
Status: NEW → ASSIGNED
Attachment #445987 - Flags: review?(jwalden+bmo)
Oops, pretend I added the test case in comment 0.
Thanks Jesse and Gary!
Attachment #445987 - Flags: review?(jwalden+bmo) → review+
http://hg.mozilla.org/tracemonkey/rev/f0f0dfd6a262
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/f0f0dfd6a262
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug566556.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.