The default bug view has changed. See this FAQ.

"Assertion failure: ss->top >= 2," or "Assertion failure: top != 0," or "Assertion failure: newtop <= oldtop,"

RESOLVED FIXED in mozilla12

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla12
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-done)

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 587175 [details]
stack

f = (function() {
    @o()
}).g()

asserts js debug shell on m-c changeset c713003d3226 without any CLI arguments at Assertion failure: ss->top >= 2,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   84036:7ab4f1ebc7cc
user:        Brian Hackett
date:        Mon Jan 09 06:29:50 2012 -0800
summary:     Backout 54cd89b0f1fa (bug 712714 backout).  Talos will probably report fake regressions for this patch, do not back out for this reason.

Just to be sure:

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   83898:78d17e22a223
parent:      83892:0ac1cbff2a67
user:        Brian Hackett
date:        Thu Jan 05 11:08:38 2012 -0800
summary:     Remove JOF_CALLOP, bug 712714. r=dvander
(Reporter)

Comment 1

5 years ago
Another testcase asserting identically as the one in comment 0:

uneval(function() {
    @o()
})

A variant asserts at:

uneval(function() {
    for (b in x) {
        @o()
    }
})

Assertion failure: top != 0,
Summary: "Assertion failure: ss->top >= 2," → "Assertion failure: ss->top >= 2," or "Assertion failure: top != 0,"
(Reporter)

Comment 2

5 years ago
(function() {
    for (let b in []) {
        ( * )()
    }
}).f()

A variant that does not involve "@" asserts at Assertion failure: newtop <= oldtop,
Summary: "Assertion failure: ss->top >= 2," or "Assertion failure: top != 0," → "Assertion failure: ss->top >= 2," or "Assertion failure: top != 0," or "Assertion failure: newtop <= oldtop,"

Comment 3

5 years ago
Both (*) and (@o) are E4X things, fwiw.
Duplicate of this bug: 716733
Created attachment 587566 [details] [diff] [review]
patch

JSOP_CALLXMLNAME still pushes two values, and needed a placeholder value when decompiling.
Assignee: general → bhackett1024
Attachment #587566 - Flags: review?(dvander)
Attachment #587566 - Flags: review?(dvander) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/246f9b345686
(Reporter)

Comment 7

5 years ago
http://hg.mozilla.org/mozilla-central/rev/246f9b345686/
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Whiteboard: js-triage-needed → js-triage-done
Target Milestone: --- → mozilla12
A testcase for this bug was automatically identified at js/src/jit-test/tests/e4x/bug716713.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.