TM: "Assertion failure: fp2->isDirectEvalOrDebuggerFrame(),"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
Mac OS X
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 534507 [details]
stack

try {
    function l() {        }
    function r() {        }
    d = 4;
    var _ = q;
} catch (e) {    }
try {
    v = ArrayBuffer();
    s = [];
    function e() {        }
    let a;
    eval("for(var[x]=e in this){(function(){})()}");
} catch (e) {    }

asserts js debug shell on JM changeset 29f08848d96c with -j at Assertion failure: fp2->isDirectEvalOrDebuggerFrame()

Comment 1

6 years ago
The first bad revision is:

changeset:   2caec858311a
user:        Jason Orendorff
date:        Wed May 11 11:11:40 2011 -0500
summary:     Bug 645160 - jsdIStackFrame is incorrectly truncated at indirect eval calls. r=mrbkap.
(Reporter)

Comment 2

6 years ago
The assert eventually mutated to Assertion failure: obj->getPrivate() == fp, due to this changeset:

http://hg.mozilla.org/mozilla-central/rev/bb9e5496b0ac

before the following changes supposedly fixed the assert:

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   72802:464f65a4cb87
user:        Luke Wagner
date:        Mon Jul 11 10:22:27 2011 -0700
summary:     Bug 669044 - Undo changes to tracer assert (r=dvander)
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.