Last Comment Bug 669044 - TM: "Assertion failure: obj->getPrivate() == fp,"
: TM: "Assertion failure: obj->getPrivate() == fp,"
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: mozilla8
Assigned To: Luke Wagner [:luke]
Depends on:
Blocks: jsfunfuzz 656462
  Show dependency treegraph
Reported: 2011-07-02 22:26 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 13:58 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

stack (3.66 KB, text/plain)
2011-07-02 22:26 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
put the assert back to the way it was (1.70 KB, patch)
2011-07-05 15:40 PDT, Luke Wagner [:luke]
dvander: review+
Details | Diff | Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-07-02 22:26:01 PDT
Created attachment 543653 [details]

for each(let y in [0, 0]) {
        for each(e in[0,0,0,0,0,0,0,0]) {\
            x = undefined\

asserts js debug shell on TM changeset f59568ec0513 with -j at Assertion failure: obj->getPrivate() == fp,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   70604:bb9e5496b0ac
user:        Luke Wagner
date:        Fri May 13 08:56:26 2011 -0700
summary:     Bug 656462, part 4 - Simplify stack code, keep track of native calls, create new iterator over native/scripted callstack, make JS_SaveFrameChain fallible (r=waldo,mrbkap)
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2011-07-02 22:41:10 PDT
Still occurs on TM changeset d8e967b8afc8.
Comment 2 Luke Wagner [:luke] 2011-07-05 15:40:00 PDT
Created attachment 544085 [details] [diff] [review]
put the assert back to the way it was

I'm not sure what possessed me to attempt to simplify this assertion (, but its clearly invalid.  This patch puts it back and adds a test.
Comment 3 David Anderson [:dvander] 2011-07-06 15:29:21 PDT
Comment on attachment 544085 [details] [diff] [review]
put the assert back to the way it was

Review of attachment 544085 [details] [diff] [review]:
Comment 4 Luke Wagner [:luke] 2011-07-11 10:26:34 PDT
Comment 5 Joe Drew (not getting mail) 2011-07-16 18:44:21 PDT
This (along with most things committed on Friday afternoon) was backed out of mozilla-inbound in order to clear up orange.
Comment 7 Marco Bonardo [::mak] 2011-07-19 08:08:29 PDT
Comment 8 Christian Holler (:decoder) 2013-01-19 13:58:54 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.