686295 - Assertion failure: cx->enumerators == obj, at jsiter.cpp:800

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 569a45bfb71c (options -m -n -a):


eval("\
Object.prototype.__defineSetter__('x', function(value) { result_x = value; });\
function Crash() {\
  for (var key in [(/\u00a5\u008d/ )]) {\
    { key : {  } try { Crash(); } catch(lineNumber) {} }  \
  }\
}\
Crash();\
");

Comment 1

[Christian Holler (:decoder)]

The test in comment 0 doesn't reproduce for me anymore at m-c revision d98fbf3cbd71. It seems the problem is still present though, this test still triggers the assertion:


loadFile("test();\
function test()\
{\
  function f(N)\
  {\
      var obj0 = {}, obj1 = {}, obj2 = {};\
      obj1['a'+i] = 0;\
      obj2['b'+(encodeURIComponent)] = 0;\
      for (var repeat = 0;repeat != 2; ++repeat) {\
        for (var j in obj1) {\
          try { for (var i in f()) { } } catch (summary) { }\
          for (var k in obj2) {\
            ++count;\
        }\
      }\
    }\
  }\
  var array = [function() { f(10); },\
    ];\
    for (var i = 0; i != array.length; ++i)\
      array[i]();\
}\
");
function loadFile(lfVarx) {
        evaluate(lfVarx);
}

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 8af2ff9c6018).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   84764:7fe6463d4547
user:        Luke Wagner
date:        Tue Jan 17 16:35:07 2012 -0800
summary:     Bug 718134 - un-union StackFrame::args (r=bhackett)

Comment 3

[Christian Holler (:decoder)]

Luke, is the fix in comment 2 plausible? Can we close this bug?

Comment 4

[Luke Wagner [:luke]]

Maybe, I'm not sure, though.