Last Comment Bug 701244 - "Assertion failure: 0,"
: "Assertion failure: 0,"
js-triage-done [qa!]
: assertion, regression, testcase, verified-beta
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
-- critical (vote)
: mozilla11
Assigned To: Luke Wagner [:luke]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz 696813
  Show dependency treegraph
Reported: 2011-11-09 17:00 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:41 PST (History)
8 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

stack (7.06 KB, text/plain)
2011-11-09 17:00 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
fix (2.45 KB, patch)
2011-11-09 17:20 PST, Luke Wagner [:luke]
no flags Details | Diff | Splinter Review
fix (1.02 KB, patch)
2011-11-09 18:05 PST, Luke Wagner [:luke]
jwalden+bmo: review+
asa: approval‑mozilla‑aurora+
Details | Diff | Splinter Review

Description User image Gary Kwong [:gkw] [:nth10sd] 2011-11-09 17:00:01 PST
Created attachment 573376 [details]

    (function() {
        function k({
            d: {
        }) {}
    }), "\
    (function() {\
        function k({\
            d: {\
        }) {}\

asserts js debug shell on m-c changeset 4fb61ebbf8ff with patch v1 from bug 697279 without any CLI arguments at Assertion failure: 0,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   79903:a6c390aa3bf2
user:        Luke Wagner
date:        Mon Nov 07 11:46:25 2011 -0800
summary:     Bug 696813 - Simplify Decompile (r=waldo)
Comment 1 User image Luke Wagner [:luke] 2011-11-09 17:20:35 PST
Created attachment 573384 [details] [diff] [review]

Mmm destructuring.
Comment 2 User image Luke Wagner [:luke] 2011-11-09 18:05:26 PST
Created attachment 573396 [details] [diff] [review]

Oops, patch should not include nsJSEnvironment hackery...
Comment 3 User image Luke Wagner [:luke] 2011-11-09 18:27:42 PST
Comment on attachment 573396 [details] [diff] [review]

Low-risk fix (backing out overzealous removal).
Comment 5 User image Marco Bonardo [::mak] 2011-11-11 02:25:55 PST
Comment 7 User image Mihaela Velimiroviciu (:mihaelav) 2012-01-27 06:36:53 PST
OS; Mac OS X 10.6

I used the beta source with the latest revision (mozilla-beta-226c1a05e0b6) and built the js debug shell; then I run the test from comment #0 (./js testcaseFile) and no message was displayed. 
Is this what was needed to verify this issue?
Comment 8 User image Christian Holler (:decoder) 2012-01-27 07:18:05 PST
(In reply to Mihaela Velimiroviciu [QA] from comment #7)
> Is this what was needed to verify this issue?

Yes that sounds alright. In general if you are not sure if you're testing correctly, try building the debug shell in both the most current and unfixed revisions to see the assertion going away :)
Comment 9 User image Mihaela Velimiroviciu (:mihaelav) 2012-01-29 23:44:36 PST
Setting VERIFIED based on previous comment. Thank you!
Comment 10 User image Christian Holler (:decoder) 2013-01-14 08:41:52 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug701244.js.

Note You need to log in before you can comment on or make changes to this bug.