Closed Bug 701248 Opened 13 years ago Closed 13 years ago

Assertion failure: ((js::SrcNoteType)(((*(sn) >> 3) >= SRC_XDELTA) ? SRC_XDELTA : *(sn) >> 3)) == SRC_DESTRUCT, at jsopcode.cpp:3543

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Tracking Flags:
Tracking Status
firefox8 - wontfix
firefox9 + fixed
firefox10 + fixed
firefox11 + verified
status1.9.2 --- unaffected

People

(Reporter: decoder, Assigned: Waldo)

References

Details

(Keywords: assertion, testcase, verified-beta, Whiteboard: [sg:critical] fixed by 685321 [qa!]) 

The following test asserts on mozilla-central revision c60535115ea1 (no options required):


function F(x, y) {
  var { j, y, p, a } = testSyntax("#1=<a>b</a>", true) =  this;
}
var src = F.toSource(-1)+"\n";


Could be related to a decompiler patch that landed recently, Cc'ing Luke and Waldo.
Reduced somewhat (potentially morphing, but I don't quite think so), I get this:

  (function F(x) { var {x} = this; }).toSource(-1);

That implicates bug 685321, which I really need to get to soon.  :-\
Group: core-security
"depends on" rather than "dupe" in case of morphing, but if a patch for that bug fixes this one we can dupe at that time. Please include both Christian's original and your variant as regression tests when you check in.
Depends on: 685321
Whiteboard: js-triage-needed → [sg:critical] js-triage-needed
Jeff, recording you as assignee since you're working on the likely dup.
Assignee: general → jwalden+bmo
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Would like decoder to verify that the fix for bug 685321 really does fix his testcase.
status-firefox11: affected → fixed
Resolution: DUPLICATE → FIXED
Whiteboard: [sg:critical] js-triage-needed → [sg:critical] fixed by 685321
Confirmed that the test in comment 0 no longer reproduces on trunk.
Whiteboard: [sg:critical] fixed by 685321 → [sg:critical] fixed by 685321 [qa+]
Group: core-security
OS: Ubuntu 11.04 64bit
I have built the js from mozilla-beta-52cf2b0c8439 and run the tests from comment #0 and comment #1 and no error was displayed.
Status: RESOLVED → VERIFIED
status-firefox11: fixed → verified
Keywords: verified-beta
Whiteboard: [sg:critical] fixed by 685321 [qa+] → [sg:critical] fixed by 685321 [qa!]
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.