Closed Bug 896126 Opened 7 years ago Closed 7 years ago

Assertion failure: parent, at jswrapper.cpp

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla25
Tracking Status
firefox23 --- affected
firefox24 --- fixed
firefox25 --- fixed
firefox-esr17 --- unaffected
b2g18 --- unaffected

People

(Reporter: gkw, Assigned: bholley)

References

Details

(4 keywords, Whiteboard: [jsbugmon:update][adv-main24+])

Attachments

(4 files)

Attached file stack
({
    r: function() {
        function f() {
            w[0xe56241c6 >> 3]
        }
    },
    s: function() {
        "use asm"
        return (1 for

asserts js debug shell on m-c changeset 0d0263a58f06 without any CLI arguments at Assertion failure: parent, at jswrapper.cpp
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/d09d109a7e88
user:        Bobby Holley
date:        Wed Jul 17 11:53:52 2013 -0700
summary:     Bug 887334 - Use the new AutoCompartment overload for the atoms compartment and remove AutoEnterAtomsCompartment. r=bhackett
Flags: needinfo?(bobbyholley+bmo)
LangFuzz also found tests for this, but they involve gczeal:

gczeal(2,1);
function runTestCase(testcase) {
        $ERROR('Test case returned non-true value!');
}
function newFunc(x) { new Function(x)(); };
newFunc("\
function testcase() {\
  \"use strict\";\
  try {} catch (eval) {}\
}\
runTestCase(testcase);\
");


Marking s-s based on that.
Group: core-security
I can reproduce using:

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-07-22-mozilla-central-debug/jsshell-mac64.zip

./js testcase.js

Assertion failure: parent, at ../../../js/src/jswrapper.cpp:35
Ah, I was doing |./js < testcase.js|. Gary explained IRL that I need to drop the |<|.
Flags: needinfo?(bobbyholley+bmo)
Assignee: general → bobbyholley+bmo
Attachment #779368 - Flags: review? → review?(luke)
Keywords: sec-high
Attachment #779368 - Flags: review?(luke) → review+
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision b717a7945dfb).
https://hg.mozilla.org/mozilla-central/rev/de1042bf3026
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update]
Status: RESOLVED → VERIFIED
JSBugMon: This bug has been automatically verified fixed.
(In reply to Bobby Holley (:bholley) from comment #12)
> https://hg.mozilla.org/releases/mozilla-aurora/
> pushloghtml?changeset=84b828b63115

Backed out from Aurora for possibly causing xpcshell crashes along with the other changes from bholley's push in https://hg.mozilla.org/releases/mozilla-aurora/rev/659b0d61fbc6
(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #1)
> autoBisect shows this is probably related to the following changeset:
> 
> The first bad revision is:
> changeset:   http://hg.mozilla.org/mozilla-central/rev/d09d109a7e88
> user:        Bobby Holley
> date:        Wed Jul 17 11:53:52 2013 -0700
> summary:     Bug 887334 - Use the new AutoCompartment overload for the atoms
> compartment and remove AutoEnterAtomsCompartment. r=bhackett

If this was the regression, why did this affect Firefox 24? Firefox 25 was trunk then.
Probably the wrong regressing bug? bholley might know.
(In reply to Al Billings [:abillings] from comment #17)
> (In reply to Gary Kwong [:gkw] [:nth10sd] from comment #1)
> > autoBisect shows this is probably related to the following changeset:
> > 
> > The first bad revision is:
> > changeset:   http://hg.mozilla.org/mozilla-central/rev/d09d109a7e88
> > user:        Bobby Holley
> > date:        Wed Jul 17 11:53:52 2013 -0700
> > summary:     Bug 887334 - Use the new AutoCompartment overload for the atoms
> > compartment and remove AutoEnterAtomsCompartment. r=bhackett
> 
> If this was the regression, why did this affect Firefox 24? Firefox 25 was
> trunk then.

Because I backported bug 887334 to 24.
Whiteboard: [jsbugmon:update] → [jsbugmon:update][adv-main24+]
regressing bug was not backported to ESR17 or b2g18
Group: core-security
You need to log in before you can comment on or make changes to this bug.