Note: There are a few cases of duplicates in user autocompletion which are being worked on.

"Assertion failure: !JSID_IS_VOID(lastProp->id)," with gc

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 betaN+, status1.9.2 unaffected, status1.9.1 unaffected)

Details

(Reporter)

Description

7 years ago
x = Proxy.create((function () {
    return {
        get: Object.create
    }
})([]), "")
try {
    (function () {
        for each(l in [0]) {
            print(x)
        }
    })()
} catch (e) {}
gc()
for each(let a in [0]) {
    print(x)
}

asserts js debug shell on TM changeset e8ee411dca70 without -j at Assertion failure: !JSID_IS_VOID(lastProp->id), when passed in as a CLI argument.

s-s because this involves gc..
(Reporter)

Updated

7 years ago
blocking2.0: --- → ?
(Reporter)

Comment 1

7 years ago
Probably related to bug 558451.

Regression window:

http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=be9979b4c10b&tochange=f3e58c264932
Blocks: 558451
status1.9.1: --- → unaffected
status1.9.2: --- → unaffected

Updated

7 years ago
blocking2.0: ? → betaN+
Another WFM that wants to be FIXED with fix-patch bug citation.

/be
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → WORKSFORME

Comment 3

7 years ago
The first good revision is:
changeset:   52696:ef7cd335c64e
parent:      52694:d575f16c7f55
parent:      51607:f3e58c264932
user:        David Mandelin <dmandelin@mozilla.com>
date:        Mon Aug 30 15:19:36 2010 -0700
summary:     [JAEGER] Merge from Tracemonkey.

Comment 4

7 years ago
The common ancestor of those changesets is the completely busted:

changeset:   51604:e5958cd4a135
user:        Brendan Eich <brendan@mozilla.org>
date:        Sun Aug 29 11:57:08 2010 -0700
summary:     Merge JSScope into JSObject and JSScopeProperty (now js::Shape; bug 558451, r=jorendorff).

Comment 5

7 years ago
I suspect hg bisect is correct, but it's hard to tell.  And if it is correct, we don't really know what fixed the bug.

In the future, PLEASE don't land on top of brokenness and then back out the brokenness by hand.  And for the sake of all that is sane, don't merge between project branches unless both are green.

Comment 6

7 years ago
Brendan says "if bug 595365 was not involved in fixing the problem, then it must have been bug 593256".
Resolution: WORKSFORME → FIXED
Group: core-security
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.