Last Comment Bug 669044 - TM: "Assertion failure: obj->getPrivate() == fp,"
: TM: "Assertion failure: obj->getPrivate() == fp,"
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
-- critical (vote)
: mozilla8
Assigned To: Luke Wagner [:luke]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz 656462
  Show dependency treegraph
Reported: 2011-07-02 22:26 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 13:58 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

stack (3.66 KB, text/plain)
2011-07-02 22:26 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
put the assert back to the way it was (1.70 KB, patch)
2011-07-05 15:40 PDT, Luke Wagner [:luke]
dvander: review+
Details | Diff | Splinter Review

Description User image Gary Kwong [:gkw] [:nth10sd] 2011-07-02 22:26:01 PDT
Created attachment 543653 [details]

for each(let y in [0, 0]) {
        for each(e in[0,0,0,0,0,0,0,0]) {\
            x = undefined\

asserts js debug shell on TM changeset f59568ec0513 with -j at Assertion failure: obj->getPrivate() == fp,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   70604:bb9e5496b0ac
user:        Luke Wagner
date:        Fri May 13 08:56:26 2011 -0700
summary:     Bug 656462, part 4 - Simplify stack code, keep track of native calls, create new iterator over native/scripted callstack, make JS_SaveFrameChain fallible (r=waldo,mrbkap)
Comment 1 User image Gary Kwong [:gkw] [:nth10sd] 2011-07-02 22:41:10 PDT
Still occurs on TM changeset d8e967b8afc8.
Comment 2 User image Luke Wagner [:luke] 2011-07-05 15:40:00 PDT
Created attachment 544085 [details] [diff] [review]
put the assert back to the way it was

I'm not sure what possessed me to attempt to simplify this assertion (, but its clearly invalid.  This patch puts it back and adds a test.
Comment 3 User image David Anderson [:dvander] 2011-07-06 15:29:21 PDT
Comment on attachment 544085 [details] [diff] [review]
put the assert back to the way it was

Review of attachment 544085 [details] [diff] [review]:
Comment 4 User image Luke Wagner [:luke] 2011-07-11 10:26:34 PDT
Comment 5 User image Joe Drew (not getting mail) 2011-07-16 18:44:21 PDT
This (along with most things committed on Friday afternoon) was backed out of mozilla-inbound in order to clear up orange.
Comment 7 User image Marco Bonardo [::mak] 2011-07-19 08:08:29 PDT
Comment 8 User image Christian Holler (:decoder) 2013-01-19 13:58:54 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.