Closed Bug 637385 Opened 13 years ago Closed 13 years ago

TM: Assertion failure: obj == globalObj, at ../jstracer.cpp:15253

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla2.0

People

(Reporter: jandem, Assigned: Waldo)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(2 files)

Stack trace
1.68 KB, text/plain
Details
Patch and test
2.77 KB, patch
dvander
: review+
dmandelin
: approval2.0+
Details | Diff | Splinter Review 
--
"use strict"; 
eval("var i = 0; for(i = 0; i < 20; i++) { i = 0; }");
--
This asserts with -j in a debug build:

$ ./js -j test.js
Assertion failure: obj == globalObj, at ../jstracer.cpp:15253

Does not crash in a release build (loops infinitely but that's expected)

decoder found this bug, but asked me to file it after I reduced it.
Attached file Stack trace — 

    
  
Assignee: general → jwalden+bmo

    
    

    
  

      
      
      
      

        Attached patch
          
          
        Patch and test
        — 
          — Splinter Review
      

    


  

        Attachment #515731 -
        Flags: review?(dvander)
Version: unspecified → Trunk

        Attachment #515731 -
        Flags: review?(dvander) → review+

    
    

    
  
Nice.

/be

    
    

    
  
Comment on attachment 515731 [details] [diff] [review]
Patch and test

Nominating for approval because so this does not trip up fuzzers and asserts are bad.

        Attachment #515731 -
        Flags: approval2.0?

        Attachment #515731 -
        Flags: approval2.0? → approval2.0+

    
    

    
  
http://hg.mozilla.org/tracemonkey/rev/45d79efe4418
http://hg.mozilla.org/mozilla-central/rev/c1aecf6ba5e7
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla2.0

          You need to log in
          before you can comment on or make changes to this bug.