Last Comment Bug 705879 - "Assertion failure: isGlobal(),"
: "Assertion failure: isGlobal(),"
Status: VERIFIED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: mozilla11
Assigned To: Luke Wagner [:luke]
:
: Jason Orendorff [:jorendorff]
Mentors:
: 709929 (view as bug list)
Depends on:
Blocks: jsfunfuzz
  Show dependency treegraph
 
Reported: 2011-11-28 14:06 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-12-13 17:06 PST (History)
5 users (show)
Ms2ger: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (5.40 KB, text/plain)
2011-11-28 14:06 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
fix (1.70 KB, patch)
2011-12-07 15:51 PST, Luke Wagner [:luke]
bhackett1024: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-11-28 14:06:50 PST
Created attachment 577371 [details]
stack

f = eval("\
  (function() {\
    with({}) {\
      yield\
    }\
    for(let d in[gc()])\
    for(b in[0,function(){}]);\
  })\
")
for (e in f()) {}

asserts js debug shell on JM changeset 5546f57c9567 without any CLI flags at Assertion failure: isGlobal(),

Doesn't seem to occur with m-c changeset bc48009a6bbb.

(not sure if the following is correct):

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   79616:d6352d960dd2
parent:      79349:f951e9151626
parent:      79615:921e1db5cf11
user:        Brian Hackett
date:        Wed Nov 02 09:23:25 2011 -0700
summary:     Merge MC -> JM
Comment 1 Brian Hackett (:bhackett) 2011-11-28 17:48:50 PST
I can't repro on the named revision and architecture.
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2011-11-28 18:10:51 PST
(In reply to Brian Hackett (:bhackett) from comment #1)
> I can't repro on the named revision and architecture.

I can definitely still reproduce this on a 32-bit debug shell on JM rev 1e8c03ba91d0 without any CLI flags.
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2011-12-01 14:28:03 PST
> I can definitely still reproduce this on a 32-bit debug shell on JM rev
> 1e8c03ba91d0 without any CLI flags.

There was some offline discussion about this being possibly platform and configuration-specific and being potentially fixed by bug 692274.
Comment 4 Gary Kwong [:gkw] [:nth10sd] 2011-12-07 15:37:51 PST
> There was some offline discussion about this being possibly platform and
> configuration-specific and being potentially fixed by bug 692274.

This still reproduces with the patch in comment 35 in bug 692274 applied on m-c rev 7ab478082ca7. Testing m-c because ObjShrink has landed on m-c.

Luke, any ideas on why this still occurs? (when Brian and I last spoke, this doesn't really seem directly related to ObjShrink)
Comment 5 Luke Wagner [:luke] 2011-12-07 15:48:26 PST
(In reply to Gary Kwong [:gkw, :nth10sd] from comment #4)
> Luke, any ideas on why this still occurs? (when Brian and I last spoke, this
> doesn't really seem directly related to ObjShrink)

Yeah, it's ObjShrink: 'priv' is a stale stack frame stored in the generator object, this code should use the live frame (on the stack), i.e., 'fp'.
Comment 6 Luke Wagner [:luke] 2011-12-07 15:51:29 PST
Created attachment 579881 [details] [diff] [review]
fix
Comment 7 Gary Kwong [:gkw] [:nth10sd] 2011-12-08 11:40:34 PST
(In reply to Luke Wagner [:luke] from comment #6)
> Created attachment 579881 [details] [diff] [review]
> fix

(setting assignee to Luke since he has an r+ patch - ready for checkin!)
Comment 8 Brian Hackett (:bhackett) 2011-12-12 18:38:29 PST
*** Bug 709929 has been marked as a duplicate of this bug. ***
Comment 9 Gary Kwong [:gkw] [:nth10sd] 2011-12-12 18:53:07 PST
The testcase in bug 709929 should also be landed.
Comment 10 Luke Wagner [:luke] 2011-12-13 09:48:18 PST
Righto.  Will land when m-i kerfuffle clears up; sorry for not landing earlier.
Comment 11 Gary Kwong [:gkw] [:nth10sd] 2011-12-14 16:05:26 PST
(In reply to Gary Kwong [:gkw, :nth10sd] from comment #9)
> The testcase in bug 709929 should also be landed.

Here's another testcase which crashes debug shell that is fixed by the patch here:

f = (function() {
    function shapeyConstructor(qvhvyl) {
        Object.defineProperty(qvhvyl, "", ({
            e: true
        }));
        gc();
    }
    for each(let x in [Number, Number, new Number]) {
        try {
            let g = shapeyConstructor(x);
            with({}) {
                with([]) yield
                }
            } catch (e) {
            }
        }
    })
for (i in f()) {}
Comment 13 :Ms2ger (⌚ UTC+1/+2) 2011-12-16 05:41:49 PST
https://hg.mozilla.org/mozilla-central/rev/ebfc6414c4dc
Comment 14 Gary Kwong [:gkw] [:nth10sd] 2012-12-13 17:06:12 PST
A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.

Note You need to log in before you can comment on or make changes to this bug.