If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

IonMonkey: Assertion failure: cx->enumerators == obj, at jsiter.cpp:945

RESOLVED FIXED in mozilla13

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Assigned: dvander)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
mozilla13
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

6 years ago
The following testcase asserts on ionmonkey revision 5a04fd69aa09 (run with --ion -n -m), tested on 64 bit:


var patterns = new Array(); 
patterns[0] = '';
test();
function test() {
  for (i in patterns) {
    s = patterns[i];
    status =(test)(s);  
  }
}
(Assignee)

Comment 1

6 years ago
Created attachment 600297 [details] [diff] [review]
fix
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #600297 - Flags: review?(luke)

Comment 2

6 years ago
Comment on attachment 600297 [details] [diff] [review]
fix

(since I'm new here) nice choice on naming it "IonActivation"

>+    // We need to close all iterators that are open on the stack.
>+    while (cx->enumerators != cx->runtime->ionActivation->savedEnumerators()) {
>+        Value v = cx->getPendingException();
>+        cx->clearPendingException();
>+        if (js_CloseIterator(cx, cx->enumerators))
>+            cx->setPendingException(v);
>+    }

I was wondering if we can't factor out this exception-play, either into js_CloseIterator, if there are some callers which don't want that exception behavior, into a function that calls js_CloseIterator called by here and js::Interpret.  To minimize patch burden, perhaps this factoring could be landed as a separate patch on m-c?  (If you agree and want to do such a patch, can you un-JS_FRIEND_API js_ValueToIterator/js_CloseIterator?)
(Assignee)

Comment 3

6 years ago
Created attachment 600591 [details] [diff] [review]
v2
Attachment #600297 - Attachment is obsolete: true
Attachment #600591 - Flags: review?(luke)
Attachment #600297 - Flags: review?(luke)

Comment 4

6 years ago
Comment on attachment 600591 [details] [diff] [review]
v2

Righton
Attachment #600591 - Flags: review?(luke) → review+
(Assignee)

Comment 5

6 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/aec23eb06a3e
https://hg.mozilla.org/mozilla-central/rev/aec23eb06a3e
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla13
(Assignee)

Comment 7

6 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/251bea6ccff8
(Reporter)

Comment 8

5 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.