Last Comment Bug 704134 - [ObjShrink]: Assertion failure: pobj == found, at jsinterp.cpp:1459
: [ObjShrink]: Assertion failure: pobj == found, at jsinterp.cpp:1459
Status: VERIFIED FIXED
[qa!]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- critical (vote)
: mozilla11
Assigned To: Brian Hackett (:bhackett)
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: infer-regress langfuzz
  Show dependency treegraph
 
Reported: 2011-11-21 07:24 PST by Christian Holler (:decoder)
Modified: 2013-01-14 08:39 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
verified
verified
verified


Attachments
patch (2.08 KB, patch)
2011-11-22 13:52 PST, Brian Hackett (:bhackett)
luke: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2011-11-21 07:24:15 PST
The following testcase asserts on jaegermonkey branch revision a335853be219 (run with -m -n -a), tested on 64 bit:


function f(s) {
    eval(s);
    return function() {
        with({}) {}; // repel JägerMonkey
            return b;
    };
}
var b = 1;
var g1 = f("");
var g2 = f("var b = 2;");
g1('');
assertEq(g2(''), 2);
Comment 1 Brian Hackett (:bhackett) 2011-11-22 13:52:08 PST
Created attachment 576248 [details] [diff] [review]
patch

The EXTENSIBLE_PARENTS flag was not getting set in some cases, as it was being masked out.  This fix treats it as an object flag so that replaceLastProperty works properly when used to set the bit.

https://hg.mozilla.org/projects/jaegermonkey/rev/1f04d4f38227
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2012-03-05 11:16:49 PST
In November 2011,

This landed on mozilla-inbound:

http://hg.mozilla.org/integration/mozilla-inbound/rev/1f04d4f38227

and mozilla-central:

http://hg.mozilla.org/mozilla-central/rev/1f04d4f38227

which I think was Firefox 11 in the nightlies.
Comment 3 Mihaela Velimiroviciu (:mihaelav) 2012-03-07 00:38:04 PST
Ubuntu 11.04 64 bit

I built Spidermonkey for the latest beta (rev d46a4577a631) and run the test from comment #0: no failure occured. 

Marking verified for Firefox 11.
Comment 4 Mihaela Velimiroviciu (:mihaelav) 2012-03-16 06:53:43 PDT
Ubuntu 11.04 64 bit

I built Jaegermonkey for the latest beta (rev 4027017bbaba) and run the test from comment #0: no failure occured. 

Marking verified for Firefox 12.
Comment 5 Mihaela Velimiroviciu (:mihaelav) 2012-05-08 23:32:40 PDT
Ubuntu 11.10 64 bit

I built Jaegermonkey for the latest beta (rev 64ffbdd90ac0) and run the test from comment #0: no failure occured. 

Marking verified for Firefox 13.
Comment 6 Christian Holler (:decoder) 2013-01-14 08:39:07 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug704134.js.

Note You need to log in before you can comment on or make changes to this bug.