Last Comment Bug 659077 - TM: "Assertion failure: fp2->isDirectEvalOrDebuggerFrame(),"
: TM: "Assertion failure: fp2->isDirectEvalOrDebuggerFrame(),"
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz
  Show dependency treegraph
 
Reported: 2011-05-23 12:08 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 14:06 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (3.37 KB, text/plain)
2011-05-23 12:08 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description Gary Kwong [:gkw] [:nth10sd] 2011-05-23 12:08:39 PDT
Created attachment 534507 [details]
stack

try {
    function l() {        }
    function r() {        }
    d = 4;
    var _ = q;
} catch (e) {    }
try {
    v = ArrayBuffer();
    s = [];
    function e() {        }
    let a;
    eval("for(var[x]=e in this){(function(){})()}");
} catch (e) {    }

asserts js debug shell on JM changeset 29f08848d96c with -j at Assertion failure: fp2->isDirectEvalOrDebuggerFrame()
Comment 1 Jesse Ruderman 2011-05-23 15:48:42 PDT
The first bad revision is:

changeset:   2caec858311a
user:        Jason Orendorff
date:        Wed May 11 11:11:40 2011 -0500
summary:     Bug 645160 - jsdIStackFrame is incorrectly truncated at indirect eval calls. r=mrbkap.
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2011-08-12 03:19:17 PDT
The assert eventually mutated to Assertion failure: obj->getPrivate() == fp, due to this changeset:

http://hg.mozilla.org/mozilla-central/rev/bb9e5496b0ac

before the following changes supposedly fixed the assert:

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   72802:464f65a4cb87
user:        Luke Wagner
date:        Mon Jul 11 10:22:27 2011 -0700
summary:     Bug 669044 - Undo changes to tracer assert (r=dvander)
Comment 3 Christian Holler (:decoder) 2013-01-19 14:06:10 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.