Closed
Bug 839758
Opened 12 years ago
Closed 12 years ago
"Assertion failure: isObject(),"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,bisect,testComment=6,ignore])
Attachments
(1 file)
424.08 KB,
text/plain
|
Details |
function f() {
try {
evalcx("(function(){\
return new function(){arguments.callee.caller()}\
})()", newGlobal())
} catch (e) {}
}
f()
f()
asserts the following js debug shell on m-c changeset 6a2bebec5914 with -a --ion-range-analysis=off :
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-02-08-mozilla-central-debug/jsshell-mac64.zip
![]() |
Reporter | |
Comment 1•12 years ago
|
||
No longer occurs with:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-02-25-mozilla-central-debug/jsshell-mac64.zip
-> WFM.
Status: NEW → RESOLVED
Closed: 12 years ago
Flags: in-testsuite?
Resolution: --- → WORKSFORME
![]() |
Reporter | |
Comment 2•12 years ago
|
||
Testcase landed via bug 845569.
Status: RESOLVED → VERIFIED
Flags: in-testsuite? → in-testsuite+
![]() |
Reporter | |
Comment 3•12 years ago
|
||
Reopening.
It still asserts, as per bug 845569 comment 4:
https://tbpl.mozilla.org/php/getParsedLog.php?id=20133306&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=20134585&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=20135134&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=20135761&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=20135881&tree=Mozilla-Inbound
Status: VERIFIED → REOPENED
Flags: in-testsuite+ → in-testsuite?
Resolution: WORKSFORME → ---
![]() |
Reporter | |
Updated•12 years ago
|
Status: REOPENED → NEW
![]() |
Reporter | |
Comment 4•12 years ago
|
||
Brian, do you know what could be the cause here? The testcase seems very intermittent.
Flags: needinfo?(bhackett1024)
![]() |
Reporter | |
Comment 5•12 years ago
|
||
As per IRC, requesting to put this unreliable testcase through LangFuzz. Thanks decoder!
Flags: needinfo?(choller)
Comment 6•12 years ago
|
||
Test for mozilla-central 0a91da5f5eab, 64 bit debug+opt build (no options required):
function reportMatch () {}
gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
function foo() {
evaluate("\
function enterFunc () {}\
test();\
function test() {\
enterFunc (new test('Date.prototype'));\
function err() { }\
}\
", { noScriptRval : true });
}
foo();
Trying to bisect it, but this test uses OOM, so probably not very reliable. Fix it while it's hot :D
Flags: needinfo?(choller)
Whiteboard: [jsbugmon:update,bisect,testComment=6]
Comment 7•12 years ago
|
||
The original bug involves too-much-recursion rather than OOM. So the artificial-OOM testcase might demonstrate a different bug.
Comment 8•12 years ago
|
||
(In reply to Jesse Ruderman from comment #7)
> The original bug involves too-much-recursion rather than OOM. So the
> artificial-OOM testcase might demonstrate a different bug.
Not necessarily because artificial OOM and too-much-recursion often trigger the same kind of bugs (I think they use the same check mechanism and both will make the callee return an error, so if the caller doesn't handle that properly, the error will trigger, no matter if it was OOM or TMR).
The stacks in this case are very close to each other too (esp. that #1 goes through js::StackFrame::constructorThis).
![]() |
Reporter | |
Comment 9•12 years ago
|
||
Setting needinfo from Naveed to find an owner.
Flags: needinfo?(nihsanullah)
![]() |
Reporter | |
Comment 10•12 years ago
|
||
This will likely go away when JaegerMonkey goes away after Baseline Compiler is landed in possibly a few weeks' time.
Flags: needinfo?(nihsanullah)
Flags: needinfo?(bhackett1024)
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisect,testComment=6] → [jsbugmon:update,bisect,testComment=6,ignore]
Comment 11•12 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 9d5f05a6d497).
![]() |
Reporter | |
Comment 12•12 years ago
|
||
Will likely be fixed by the upcoming JM removal in bug 857845. (moreover it no longer reproduces, so marking FIXED as a first step)
Status: NEW → RESOLVED
Closed: 12 years ago → 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•