Closed Bug 686295 Opened 13 years ago Closed 12 years ago

Assertion failure: cx->enumerators == obj, at jsiter.cpp:800

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: decoder, Unassigned)

Details

(Keywords: assertion, testcase, Whiteboard: js-triage-needed [jsbugmon:update,testComment=1,ignore]) 

The following test asserts on mozilla-central revision 569a45bfb71c (options -m -n -a):


eval("\
Object.prototype.__defineSetter__('x', function(value) { result_x = value; });\
function Crash() {\
  for (var key in [(/\u00a5\u008d/ )]) {\
    { key : {  } try { Crash(); } catch(lineNumber) {} }  \
  }\
}\
Crash();\
");
The test in comment 0 doesn't reproduce for me anymore at m-c revision d98fbf3cbd71. It seems the problem is still present though, this test still triggers the assertion:


loadFile("test();\
function test()\
{\
  function f(N)\
  {\
      var obj0 = {}, obj1 = {}, obj2 = {};\
      obj1['a'+i] = 0;\
      obj2['b'+(encodeURIComponent)] = 0;\
      for (var repeat = 0;repeat != 2; ++repeat) {\
        for (var j in obj1) {\
          try { for (var i in f()) { } } catch (summary) { }\
          for (var k in obj2) {\
            ++count;\
        }\
      }\
    }\
  }\
  var array = [function() { f(10); },\
    ];\
    for (var i = 0; i != array.length; ++i)\
      array[i]();\
}\
");
function loadFile(lfVarx) {
        evaluate(lfVarx);
}
Whiteboard: js-triage-needed → js-triage-needed [jsbugmon:update,bisect,bisectfix,testComment=1]
Whiteboard: js-triage-needed [jsbugmon:update,bisect,bisectfix,testComment=1] → js-triage-needed [jsbugmon:update,testComment=1,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 8af2ff9c6018).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   84764:7fe6463d4547
user:        Luke Wagner
date:        Tue Jan 17 16:35:07 2012 -0800
summary:     Bug 718134 - un-union StackFrame::args (r=bhackett)
Luke, is the fix in comment 2 plausible? Can we close this bug?
Maybe, I'm not sure, though.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.