"Assertion failure: regs->fp() == regs_->fp()->prev(),"

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
critical
RESOLVED WORKSFORME
6 years ago
3 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86_64
Mac OS X
assertion, regression, testcase
Points:
---

Firefox Tracking Flags

(firefox15 unaffected, firefox16- affected, firefox17- affected, firefox-esr10 unaffected)

Details

(Whiteboard: [js:p1:fx17])

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 644554 [details]
stack

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-06-28-mozilla-central-debug/jsshell-mac64.zip

asserts js debug shell with upcoming testcase with -m and -n at Assertion failure: regs->fp() == regs_->fp()->prev(),

Doesn't occur before 2012-06-28 so unlikely to be bug 728191.

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-06-27-mozilla-central-debug/jsshell-mac64.zip

does not assert.

Regression window points to http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5cdbeae14405&tochange=bf8f2961d0cc

JavaScript changesets were by Steve Fink and Bill McCloskey, so cc'ing them.

s-s because this only occurs on tinderbox js shells and the testcase is very resistant to reduction.
Whiteboard: [js:p1:fx17]
Keywords: regressionwindow-wanted
how bad a security problem does this assertion represent?
status-firefox-esr10: --- → unaffected
status-firefox15: --- → unaffected
status-firefox16: --- → affected
status-firefox17: --- → affected
tracking-firefox16: --- → +
tracking-firefox17: --- → +
(Reporter)

Comment 4

6 years ago
(In reply to Gary Kwong [:gkw, :nth10sd] from comment #2)
> Still occurs with
> http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-07-20-mozilla-
> central-debug/jsshell-mac64.zip

After some digging, here's a piece of good news:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012-08-09-mozilla-central-debug/jsshell-mac64.zip

does not assert.

I'll try to get a fix window.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
(Reporter)

Comment 5

6 years ago
Fix window:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3a05d298599e&tochange=045c11dd41a6

(opening up as well, since there's nothing more s-s here)
Group: core-security
tracking-firefox16: + → -
tracking-firefox17: + → -
Keywords: regressionwindow-wanted
You need to log in before you can comment on or make changes to this bug.