637385 - TM: Assertion failure: obj == globalObj, at ../jstracer.cpp:15253

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
"use strict"; 
eval("var i = 0; for(i = 0; i < 20; i++) { i = 0; }");
--
This asserts with -j in a debug build:

$ ./js -j test.js
Assertion failure: obj == globalObj, at ../jstracer.cpp:15253

Does not crash in a release build (loops infinitely but that's expected)

decoder found this bug, but asked me to file it after I reduced it.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Stack trace

Comment 2

[Jeff Walden [:Waldo]]

Attachment: Patch and test

Comment 3

[Brendan Eich [:brendan]]

Nice.

/be

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 515731 [details] [diff] [review]
Patch and test

Nominating for approval because so this does not trip up fuzzers and asserts are bad.

Comment 5

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/45d79efe4418
http://hg.mozilla.org/mozilla-central/rev/c1aecf6ba5e7