Last Comment Bug 716713 - "Assertion failure: ss->top >= 2," or "Assertion failure: top != 0," or "Assertion failure: newtop <= oldtop,"
: "Assertion failure: ss->top >= 2," or "Assertion failure: top != 0," or "Asse...
Status: RESOLVED FIXED
js-triage-done
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: mozilla12
Assigned To: Brian Hackett (:bhackett)
:
: Jason Orendorff [:jorendorff]
Mentors:
: 716733 (view as bug list)
Depends on:
Blocks: jsfunfuzz 712714
  Show dependency treegraph
 
Reported: 2012-01-09 15:31 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 07:44 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (5.20 KB, text/plain)
2012-01-09 15:31 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
patch (986 bytes, patch)
2012-01-10 18:25 PST, Brian Hackett (:bhackett)
dvander: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-01-09 15:31:39 PST
Created attachment 587175 [details]
stack

f = (function() {
    @o()
}).g()

asserts js debug shell on m-c changeset c713003d3226 without any CLI arguments at Assertion failure: ss->top >= 2,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   84036:7ab4f1ebc7cc
user:        Brian Hackett
date:        Mon Jan 09 06:29:50 2012 -0800
summary:     Backout 54cd89b0f1fa (bug 712714 backout).  Talos will probably report fake regressions for this patch, do not back out for this reason.

Just to be sure:

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   83898:78d17e22a223
parent:      83892:0ac1cbff2a67
user:        Brian Hackett
date:        Thu Jan 05 11:08:38 2012 -0800
summary:     Remove JOF_CALLOP, bug 712714. r=dvander
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-01-09 15:50:22 PST
Another testcase asserting identically as the one in comment 0:

uneval(function() {
    @o()
})

A variant asserts at:

uneval(function() {
    for (b in x) {
        @o()
    }
})

Assertion failure: top != 0,
Comment 2 Gary Kwong [:gkw] [:nth10sd] 2012-01-09 17:00:57 PST
(function() {
    for (let b in []) {
        ( * )()
    }
}).f()

A variant that does not involve "@" asserts at Assertion failure: newtop <= oldtop,
Comment 3 Jesse Ruderman 2012-01-09 18:01:27 PST
Both (*) and (@o) are E4X things, fwiw.
Comment 4 Brian Hackett (:bhackett) 2012-01-10 18:23:10 PST
*** Bug 716733 has been marked as a duplicate of this bug. ***
Comment 5 Brian Hackett (:bhackett) 2012-01-10 18:25:57 PST
Created attachment 587566 [details] [diff] [review]
patch

JSOP_CALLXMLNAME still pushes two values, and needed a placeholder value when decompiling.
Comment 6 Brian Hackett (:bhackett) 2012-01-10 18:38:57 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/246f9b345686
Comment 7 Gary Kwong [:gkw] [:nth10sd] 2012-01-11 13:05:44 PST
http://hg.mozilla.org/mozilla-central/rev/246f9b345686/
Comment 8 Christian Holler (:decoder) 2013-01-14 07:44:46 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/e4x/bug716713.js.

Note You need to log in before you can comment on or make changes to this bug.