Last Comment Bug 683470 - "Assertion failure: *f.regs.pc == JSOP_CALL || *f.regs.pc == JSOP_NEW || *f.regs.pc == JSOP_EVAL || *f.regs.pc == JSOP_FUNCALL || *f.regs.pc == JSOP_FUNAPPLY," with trap
: "Assertion failure: *f.regs.pc == JSOP_CALL || *f.regs.pc == JSOP_NEW || *f.r...
Status: RESOLVED FIXED
[js-triage-done]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Windows 7
: -- critical (vote)
: mozilla9
Assigned To: Luke Wagner [:luke]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz
  Show dependency treegraph
 
Reported: 2011-08-31 04:16 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:16 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
dis() information (2.13 KB, text/plain)
2011-08-31 04:16 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
fix assert (1.54 KB, patch)
2011-08-31 15:29 PDT, Luke Wagner [:luke]
dvander: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-08-31 04:16:03 PDT
Created attachment 557115 [details]
dis() information

f = (function() {
  function b() {
    "use strict";
    Object.defineProperty(this, "x", ({}));
  }
  for each(let d in [0, 0]) {
    try {
      b(d);
    } catch (e) {}
  }
})
dis(f)
trap(f, 54, undefined);
f()

asserts js debug shell on MC changeset fcca99426576 with -m, -a and -d at Assertion failure: *f.regs.pc == JSOP_CALL || *f.regs.pc == JSOP_NEW || *f.regs.pc == JSOP_EVAL || *f.regs.pc == JSOP_FUNCALL || *f.regs.pc == JSOP_FUNAPPLY,
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2011-08-31 04:18:04 PDT
Not sure if this is related to TI, the assert seems to be at methodjit/InvokeHelpers.cpp:188
Comment 2 Luke Wagner [:luke] 2011-08-31 15:29:24 PDT
Created attachment 557344 [details] [diff] [review]
fix assert

Oops, assert should use js_GetOpcode.
Comment 4 Ed Morley [:emorley] 2011-09-01 01:54:37 PDT
http://hg.mozilla.org/mozilla-central/rev/ebfdb0858947
Comment 5 Christian Holler (:decoder) 2013-01-14 08:16:15 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug683470.js.

Note You need to log in before you can comment on or make changes to this bug.