851362 - Rooting Analysis: Assertion failure: !js::RootMethods<T>::poisoned(v), at ./dist/include/js/RootingAPI.h:251

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central built with --enable-root-analysis, revision 8e68f4d73ec4 (run with ):


var callStack = new Array();
function enterFunc (funcName) {
  funcName += "()";
  callStack.push(funcName);
}
function exitFunc (funcName) {
  var lastFunc = callStack.pop();
}
Object.prototype.__defineSetter__(1, function () {});
gczeal(6);
function test() {
  enterFunc ('test');
  exitFunc ('test');
}
var a = [1, 2, 3, 4];
for (var v of a) {
    test();
    a.unshift('x');
}

Comment 1

[Terrence Cole [:terrence]]

Sorry, I totally missed this when you filed it. I was not able to reproduce on the given revision with:

CC="gcc -m32" CXX="g++ -m32" ./configure --enable-optimize --enable-debug --target=i686-linux-gnu --disable-threadsafe --enable-root-analysis --enable-gczeal --enable-valgrind --enable-more-deterministic --with-system-nspr

gcc (Gentoo 4.6.3 p1.13, pie-0.5.2) 4.6.3

I also tried a 64 bit build without success.

Comment 2

[Terrence Cole [:terrence]]

Because of the high false postive rate and difficulty of reproducing these bugs, we have switched our efforts to static analysis and zeal 7.