Last Comment Bug 701244 - "Assertion failure: 0,"
: "Assertion failure: 0,"
Status: VERIFIED FIXED
js-triage-done [qa!]
: assertion, regression, testcase, verified-beta
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: mozilla11
Assigned To: Luke Wagner [:luke]
:
Mentors:
Depends on:
Blocks: jsfunfuzz 696813
  Show dependency treegraph
 
Reported: 2011-11-09 17:00 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:41 PST (History)
8 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
verified


Attachments
stack (7.06 KB, text/plain)
2011-11-09 17:00 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
fix (2.45 KB, patch)
2011-11-09 17:20 PST, Luke Wagner [:luke]
no flags Details | Diff | Splinter Review
fix (1.02 KB, patch)
2011-11-09 18:05 PST, Luke Wagner [:luke]
jwalden+bmo: review+
asa: approval‑mozilla‑aurora+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-11-09 17:00:01 PST
Created attachment 573376 [details]
stack

String(
    (function() {
        function k({
            d: {
                length
            }
        }) {}
    }), "\
    (function() {\
        function k({\
            d: {\
                length\
            }\
        }) {}\
    })\
")

asserts js debug shell on m-c changeset 4fb61ebbf8ff with patch v1 from bug 697279 without any CLI arguments at Assertion failure: 0,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   79903:a6c390aa3bf2
user:        Luke Wagner
date:        Mon Nov 07 11:46:25 2011 -0800
summary:     Bug 696813 - Simplify Decompile (r=waldo)
Comment 1 Luke Wagner [:luke] 2011-11-09 17:20:35 PST
Created attachment 573384 [details] [diff] [review]
fix

Mmm destructuring.
Comment 2 Luke Wagner [:luke] 2011-11-09 18:05:26 PST
Created attachment 573396 [details] [diff] [review]
fix

Oops, patch should not include nsJSEnvironment hackery...
Comment 3 Luke Wagner [:luke] 2011-11-09 18:27:42 PST
Comment on attachment 573396 [details] [diff] [review]
fix

Low-risk fix (backing out overzealous removal).
Comment 5 Marco Bonardo [::mak] (Away 6-20 Aug) 2011-11-11 02:25:55 PST
https://hg.mozilla.org/mozilla-central/rev/b7d2f71b4c87
Comment 7 Mihaela Velimiroviciu (:mihaelav) 2012-01-27 06:36:53 PST
OS; Mac OS X 10.6

I used the beta source with the latest revision (mozilla-beta-226c1a05e0b6) and built the js debug shell; then I run the test from comment #0 (./js testcaseFile) and no message was displayed. 
Is this what was needed to verify this issue?
Thanks!
Comment 8 Christian Holler (:decoder) 2012-01-27 07:18:05 PST
(In reply to Mihaela Velimiroviciu [QA] from comment #7)
 
> Is this what was needed to verify this issue?

Yes that sounds alright. In general if you are not sure if you're testing correctly, try building the debug shell in both the most current and unfixed revisions to see the assertion going away :)
Comment 9 Mihaela Velimiroviciu (:mihaelav) 2012-01-29 23:44:36 PST
Setting VERIFIED based on previous comment. Thank you!
Comment 10 Christian Holler (:decoder) 2013-01-14 08:41:52 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug701244.js.

Note You need to log in before you can comment on or make changes to this bug.