Closed
Bug 746395
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: obj, at ../../jsval.h:532
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 749048
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,ignore])
The following testcase asserts on ionmonkey revision 67bf9a4a1f77 (run with --ion -n):
function var_iter(v) {
yield v;
for each (let ret in var_iter(v)) {
yield ret;
}
}
for (x in var_iter([1, 2, 3, 4, 5, (0), 7, 8, 9])) x;
|
Reporter | |
Comment 1•13 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 1161f2520e9b).
|
|
Reporter | |
Updated•13 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
|
||
Comment 2•13 years ago
|
||
This bug is likely another Duplicate of bug 749048, a backtrace showing CloseLiveIterator would prove this assumption right.
|
|
Reporter | |
Comment 3•13 years ago
|
||
Assertion failure: obj, at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/jsval.h:532
Program received signal SIGABRT, Aborted.
0xf7fdf430 in __kernel_vsyscall ()
(gdb) bt
#0 0xf7fdf430 in __kernel_vsyscall ()
#1 0xf7faea90 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:42
#2 0x0846022a in MOZ_Crash () at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/mfbt/Assertions.cpp:90
#3 0x08460286 in MOZ_Assert (s=0x84abcd0 "obj", file=0x84abc48 "/tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/jsval.h", ln=532) at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/mfbt/Assertions.cpp:104
#4 0x0804ae25 in OBJECT_TO_JSVAL_IMPL (obj=0x0) at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/jsval.h:532
#5 0x0804b05f in JS::Value::setObject (this=0xffffc628, obj=...) at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/jsapi.h:337
#6 0x083ccd6f in JS::ObjectValue (obj=...) at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/jsapi.h:722
#7 0x083cedd5 in js::ion::SnapshotIterator::FromTypedPayload (type=JSVAL_TYPE_OBJECT, payload=0) at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/ion/IonFrames.cpp:571
#8 0x083ceef0 in js::ion::SnapshotIterator::slotValue (this=0xffffc5a4, slot=...) at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/ion/IonFrames.cpp:586
#9 0x083cd4d1 in js::ion::SnapshotIterator::read (this=0xffffc5a4) at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/ion/IonFrameIterator.h:201
#10 0x083ce12e in CloseLiveIterator (cx=0x8733e48, frame=..., stackSlot=0) at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/ion/IonFrames.cpp:285
#11 0x083ce2b6 in CloseLiveIterators (cx=0x8733e48, frame=...) at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/ion/IonFrames.cpp:316
#12 0x083ce36c in js::ion::HandleException (rfe=0xffffc92c) at /tmp/abc-67bf9a4a1f77-7xcOaJ/compilePath/js/src/ion/IonFrames.cpp:334
#13 0xf74cd659 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•