743315 - "Assertion failure: enumerators == cx->enumerators" with recursive getter, mjitChunkLimit

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

mjitChunkLimit(15);
function f() {
  for (var i in [1]) { p; }
}
Object.defineProperty(this, "p", { get: f });
try { p; } catch (e) { }
try { p; } catch (e) { }


./js -m -n testcase.js
Assertion failure: enumerators == cx->enumerators, at js/src/jsinterp.cpp:456

Tested using mozilla-central rev a402c2064466.

The first bad revision is:
changeset:   mozilla-central rev 67608523d1a0
user:        Luke Wagner
date:        Tue Mar 06 00:43:45 2012 -0800
summary:     Bug 732744 - rm AutoPreserveEnumerators (r=dvander)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Fixed by bug 743047.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   91192:a72502cf4dac
user:        Terrence Cole
date:        Thu Apr 05 15:54:57 2012 -0700
summary:     Bug 743047 - Make the script atoms HeapPointers; r=billm