755916 - Assertion failure: enumerators == cx->enumerators,

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Object.defineProperty(this, "t2", {
    get: function() {
        for (p in h2) {
            t2
        }
    }
})
h2 = {}
mjitChunkLimit(8)
h2.a = function() {}
Object(t2)

asserts js 64-bit debug shell on m-c changeset 65fb8b9ea0b7 with -m and -n at Assertion failure: enumerators == cx->enumerators,

Asserts on Windows 7 but apparently not on Mac OS X 10.7.

Setting s-s because I'm not sure if this is sensitive, 64-bit js shell fuzzing on Windows 7 was only turned on recently.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   92285:c4c1511bafbd
user:        Luke Wagner
date:        Fri Apr 13 18:06:40 2012 -0700
summary:     Bug 746843 - change StackFrame::scopeChain() to return a HandleObject (r=bhackett)

Comment 2

[Luke Wagner [:luke]]

Attachment: fix and test

Err, I don't know how I missed this one when I fixed the early return directly below it...

Comment 3

[Daniel Veditz [:dveditz]]

> Luke Wagner [:luke] 2012-05-16 17:47:37 PDT
> No longer blocks: 746843

Is that a mid-air, or do you mean to say that this is not a regression from bug 746843. If so do you know what it's a regression from, or is it not a regression?

If it /is/ a regression from that bug then this should not affect Firefox 13 or ESR-10, but does affect 14 and later.

Comment 4

[Luke Wagner [:luke]]

This bug results us hitting the C stack limit at just the right place, so all bug 746843 did was perturb the stack frame size a bit in debug builds so that the stars aligned to hit the limit at the right check.  Thus, there probably exists some test-cast that goes back to the original bug 732744 that asserted the invariant.

Comment 5

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1d70f1cf90e8

Comment 6

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

https://hg.mozilla.org/mozilla-central/rev/1d70f1cf90e8

Comment 7

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 8

[Jesse Ruderman]

Fixing bug 735082 would make it easier to find bugs like this, and easier to make reliable  regression tests for them.