Last Comment Bug 743315 - "Assertion failure: enumerators == cx->enumerators" with recursive getter, mjitChunkLimit
: "Assertion failure: enumerators == cx->enumerators" with recursive getter, mj...
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz 732744
  Show dependency treegraph
 
Reported: 2012-04-06 12:06 PDT by Jesse Ruderman
Modified: 2012-04-12 17:03 PDT (History)
6 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Jesse Ruderman 2012-04-06 12:06:16 PDT
mjitChunkLimit(15);
function f() {
  for (var i in [1]) { p; }
}
Object.defineProperty(this, "p", { get: f });
try { p; } catch (e) { }
try { p; } catch (e) { }


./js -m -n testcase.js
Assertion failure: enumerators == cx->enumerators, at js/src/jsinterp.cpp:456

Tested using mozilla-central rev a402c2064466.

The first bad revision is:
changeset:   mozilla-central rev 67608523d1a0
user:        Luke Wagner
date:        Tue Mar 06 00:43:45 2012 -0800
summary:     Bug 732744 - rm AutoPreserveEnumerators (r=dvander)
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-04-12 17:03:01 PDT
Fixed by bug 743047.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   91192:a72502cf4dac
user:        Terrence Cole
date:        Thu Apr 05 15:54:57 2012 -0700
summary:     Bug 743047 - Make the script atoms HeapPointers; r=billm

Note You need to log in before you can comment on or make changes to this bug.