OdinMonkey: Crash [@ js::AsmJSModule::~AsmJSModule] or Assertion failure: hasScript(), at jsfun.h

RESOLVED DUPLICATE of bug 678037

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 678037
5 years ago
3 years ago

People

(Reporter: gkw, Assigned: h4writer)

Tracking

(Blocks: 2 bugs, 4 keywords)

Trunk
x86_64
Mac OS X
assertion, crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Created attachment 762389 [details]
stacks

((function(stdlib, foreign) {
  "use asm"
  var ff = foreign.ff
  function f() {
	ff()
  }
  return f
})(this, {
  ff: Date.prototype.toLocaleString
}))

asserts js debug shell on mozilla-inbound changeset 56e47c35233e without any CLI arguments at Assertion failure: hasScript(), at jsfun.h and crashes js opt shell at js::AsmJSModule::~AsmJSModule

This changeset contains the fix for bug 882514. Tested on a 32-bit shell with --enable-threadsafe and --enable-more-deterministic, though I'm not sure if these are needed.

s-s because GC is on the stack.
(Assignee)

Comment 1

5 years ago
Regression caused by bug 860838.
Assignee: general → hv1989
Blocks: 860838

Comment 2

5 years ago
And fixed by bug 678037 which causes the same condition to occur not just with natives, but with lazily-compiled scripts.  (Test-case for that is already in the tree)
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 678037
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Group: core-security
You need to log in before you can comment on or make changes to this bug.