Last Comment Bug 721497 - Assertion failure: compartment mismatched, at ../jscntxtinlines.h:153 with dumpStack
: Assertion failure: compartment mismatched, at ../jscntxtinlines.h:153 with du...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: mozilla15
Assigned To: Jason Orendorff [:jorendorff]
:
: Jason Orendorff [:jorendorff]
Mentors:
: 723068 (view as bug list)
Depends on:
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2012-01-26 13:05 PST by Christian Holler (:decoder)
Modified: 2013-01-19 14:18 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
v1 (656 bytes, patch)
2012-05-08 10:32 PDT, Jason Orendorff [:jorendorff]
luke: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-01-26 13:05:39 PST
The following code asserts on mozilla-central revision edf8075b0333 (options -n -m -a):


var g = newGlobal('new-compartment');
var dbg = new Debugger(g);
dbg.onDebuggerStatement = function (frame) {
    assertEq(dumpStack(), true);
};
g.eval("function f(a, [b, c], {x: [y], z: w}, {q}) { debugger; }");
g.eval("f(1, [2, 3], {x: [4], z: 5}, {q: 6});");


Not sure if this is really a bug, or just a problem because of "dumpStack". There are way too many shell builtins floating around in global namespace :(
Comment 1 Chris Leary [:cdleary] (not checking bugmail) 2012-01-26 15:05:00 PST
(In reply to Christian Holler (:decoder) from comment #0)
> There are way too many shell builtins floating around in global namespace :(

Has anybody proposed making a Shell object (akin to the Math object)?
Comment 2 Jason Orendorff [:jorendorff] 2012-05-08 10:29:23 PDT
Reduced:
  var g = newGlobal('new-compartment');
  g.f = function () { dumpStack(); };
  g.eval("f();");

The comment on DumpStack in the source code says:
/*
 * This shell function is temporary (used by testStackIter.js) and should be
 * removed once JSD2 lands wholly subsumes the functionality here.
 */

JSD2 clearly isn't there yet, so I'll fix the bug. 2-line patch coming.
Comment 3 Jason Orendorff [:jorendorff] 2012-05-08 10:32:47 PDT
Created attachment 622037 [details] [diff] [review]
v1
Comment 4 Luke Wagner [:luke] 2012-05-08 10:34:29 PDT
Comment on attachment 622037 [details] [diff] [review]
v1

wrap all the values!
Comment 5 Jason Orendorff [:jorendorff] 2012-05-16 07:50:40 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/d8f95bbf161b
Comment 6 Ryan VanderMeulen [:RyanVM] 2012-05-16 19:48:43 PDT
https://hg.mozilla.org/mozilla-central/rev/d8f95bbf161b

Should this have a test?
Comment 7 Christian Holler (:decoder) 2012-08-28 05:10:06 PDT
*** Bug 723068 has been marked as a duplicate of this bug. ***
Comment 8 Christian Holler (:decoder) 2013-01-19 14:18:39 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.