[ObjShrink]: Assertion failure: pobj == found, at jsinterp.cpp:1459

VERIFIED FIXED in Firefox 11

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
mozilla11
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox11 verified, firefox12 verified, firefox13 verified)

Details

(Whiteboard: [qa!])

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following testcase asserts on jaegermonkey branch revision a335853be219 (run with -m -n -a), tested on 64 bit:


function f(s) {
    eval(s);
    return function() {
        with({}) {}; // repel JägerMonkey
            return b;
    };
}
var b = 1;
var g1 = f("");
var g2 = f("var b = 2;");
g1('');
assertEq(g2(''), 2);
(Assignee)

Comment 1

6 years ago
Created attachment 576248 [details] [diff] [review]
patch

The EXTENSIBLE_PARENTS flag was not getting set in some cases, as it was being masked out.  This fix treats it as an object flag so that replaceLastProperty works properly when used to set the bit.

https://hg.mozilla.org/projects/jaegermonkey/rev/1f04d4f38227
Assignee: general → bhackett1024
Attachment #576248 - Flags: review?(luke)

Updated

6 years ago
Attachment #576248 - Flags: review?(luke) → review+
In November 2011,

This landed on mozilla-inbound:

http://hg.mozilla.org/integration/mozilla-inbound/rev/1f04d4f38227

and mozilla-central:

http://hg.mozilla.org/mozilla-central/rev/1f04d4f38227

which I think was Firefox 11 in the nightlies.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
status-firefox11: --- → fixed
status-firefox12: --- → fixed
status-firefox13: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla11
Whiteboard: [qa+]
Ubuntu 11.04 64 bit

I built Spidermonkey for the latest beta (rev d46a4577a631) and run the test from comment #0: no failure occured. 

Marking verified for Firefox 11.
status-firefox11: fixed → verified
Ubuntu 11.04 64 bit

I built Jaegermonkey for the latest beta (rev 4027017bbaba) and run the test from comment #0: no failure occured. 

Marking verified for Firefox 12.
status-firefox12: fixed → verified
Ubuntu 11.10 64 bit

I built Jaegermonkey for the latest beta (rev 64ffbdd90ac0) and run the test from comment #0: no failure occured. 

Marking verified for Firefox 13.
Status: RESOLVED → VERIFIED
status-firefox13: fixed → verified
Whiteboard: [qa+] → [qa!]
(Reporter)

Comment 6

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug704134.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.