"Assertion failure: enumerators == cx->enumerators" with recursive getter, mjitChunkLimit

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

5 years ago
mjitChunkLimit(15);
function f() {
  for (var i in [1]) { p; }
}
Object.defineProperty(this, "p", { get: f });
try { p; } catch (e) { }
try { p; } catch (e) { }


./js -m -n testcase.js
Assertion failure: enumerators == cx->enumerators, at js/src/jsinterp.cpp:456

Tested using mozilla-central rev a402c2064466.

The first bad revision is:
changeset:   mozilla-central rev 67608523d1a0
user:        Luke Wagner
date:        Tue Mar 06 00:43:45 2012 -0800
summary:     Bug 732744 - rm AutoPreserveEnumerators (r=dvander)
Fixed by bug 743047.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   91192:a72502cf4dac
user:        Terrence Cole
date:        Thu Apr 05 15:54:57 2012 -0700
summary:     Bug 743047 - Make the script atoms HeapPointers; r=billm
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.