659077 - TM: "Assertion failure: fp2->isDirectEvalOrDebuggerFrame(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

try {
    function l() {        }
    function r() {        }
    d = 4;
    var _ = q;
} catch (e) {    }
try {
    v = ArrayBuffer();
    s = [];
    function e() {        }
    let a;
    eval("for(var[x]=e in this){(function(){})()}");
} catch (e) {    }

asserts js debug shell on JM changeset 29f08848d96c with -j at Assertion failure: fp2->isDirectEvalOrDebuggerFrame()

Comment 1

[Jesse Ruderman]

The first bad revision is:

changeset:   2caec858311a
user:        Jason Orendorff
date:        Wed May 11 11:11:40 2011 -0500
summary:     Bug 645160 - jsdIStackFrame is incorrectly truncated at indirect eval calls. r=mrbkap.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The assert eventually mutated to Assertion failure: obj->getPrivate() == fp, due to this changeset:

http://hg.mozilla.org/mozilla-central/rev/bb9e5496b0ac

before the following changes supposedly fixed the assert:

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   72802:464f65a4cb87
user:        Luke Wagner
date:        Mon Jul 11 10:22:27 2011 -0700
summary:     Bug 669044 - Undo changes to tracer assert (r=dvander)

Comment 3

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929