Closed Bug 659077 Opened 10 years ago Closed 10 years ago

TM: "Assertion failure: fp2->isDirectEvalOrDebuggerFrame(),"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file stack
try {
    function l() {        }
    function r() {        }
    d = 4;
    var _ = q;
} catch (e) {    }
try {
    v = ArrayBuffer();
    s = [];
    function e() {        }
    let a;
    eval("for(var[x]=e in this){(function(){})()}");
} catch (e) {    }

asserts js debug shell on JM changeset 29f08848d96c with -j at Assertion failure: fp2->isDirectEvalOrDebuggerFrame()
The first bad revision is:

changeset:   2caec858311a
user:        Jason Orendorff
date:        Wed May 11 11:11:40 2011 -0500
summary:     Bug 645160 - jsdIStackFrame is incorrectly truncated at indirect eval calls. r=mrbkap.
The assert eventually mutated to Assertion failure: obj->getPrivate() == fp, due to this changeset:

http://hg.mozilla.org/mozilla-central/rev/bb9e5496b0ac

before the following changes supposedly fixed the assert:

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   72802:464f65a4cb87
user:        Luke Wagner
date:        Mon Jul 11 10:22:27 2011 -0700
summary:     Bug 669044 - Undo changes to tracer assert (r=dvander)
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.