Last Comment Bug 646366 - "Assertion failure: pobj == found,"
: "Assertion failure: pobj == found,"
Status: RESOLVED FIXED
js-triage-needed
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz 554955 630996
  Show dependency treegraph
 
Reported: 2011-03-30 00:22 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2011-12-09 11:44 PST (History)
6 users (show)
gary: in‑testsuite?
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
?


Attachments

Description Gary Kwong [:gkw] [:nth10sd] 2011-03-30 00:22:35 PDT
o66 = [].__proto__
o66["hasOwnProperty"] = (5)["hasOwnProperty"]
__proto__.prototype = function() {}
_var_ = 2;
for (x in _var_) {
    _var_[x]
}
Function("for each(z in[]){z.prototype}")()

asserts js debug shell on TM changeset e6c5a67da7ae without -m nor -j at Assertion failure: pobj == found,

This was found using a combination of jsfunfuzz and jandem's method fuzzer.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   63295:67b102d581dd
user:        Jim Blandy
date:        Tue Mar 15 12:18:36 2011 -0700
summary:     Bug 554955: Give blocks and call objects unique shapes when they have parents that may be extended with new bindings. r=jorendorff

Top 4 lines of backtrace:
(gdb) bt
#0  0x00000001001c0166 in JS_Assert (s=0x1003167f5 "pobj == found", file=0x100317a48 "/Users/fuzz4/Desktop/jsfunfuzz-dbg-64-tm-63591-e6c5a67da7ae/compilePath/jsinterp.cpp", ln=2032) at /Users/fuzz4/Desktop/jsfunfuzz-dbg-64-tm-63591-e6c5a67da7ae/compilePath/jsutil.cpp:86
#1  0x00000001000c37c8 in AssertValidPropertyCacheHit (cx=0x1008126b0, script=0x100815000, regs=@0x7fff5fbfe0c0, pcoff=0, start=0x100d131b8, found=0x100d030d8, entry=0x1007b2150) at /Users/fuzz4/Desktop/jsfunfuzz-dbg-64-tm-63591-e6c5a67da7ae/compilePath/jsinterp.cpp:2032
#2  0x00000001000d940d in js::Interpret () at /Users/fuzz4/Desktop/jsfunfuzz-dbg-64-tm-63591-e6c5a67da7ae/compilePath/jsinterp.cpp:4133
#3  0x00000001000f005f in js::RunScript (cx=0x1008126b0, script=0x100814cd0, fp=0x100900048) at jsinterp.cpp:636
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2011-12-08 14:37:41 PST
Seems to WFM now. Probably fixed by bug 694561.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   81261:8f3d52b0fc52
user:        Brian Hackett
date:        Fri Oct 14 13:51:21 2011 -0700
summary:     Move rarely set object flags to BaseShape, bug 694561.

Note You need to log in before you can comment on or make changes to this bug.