Assertion failure: obj == cacheResult, at jscompartment.h

RESOLVED WORKSFORME

Status

()

--
critical
RESOLVED WORKSFORME
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: bholley)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla26
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:])

Attachments

(1 attachment)

Created attachment 795556 [details]
stack

function f(code) {
    try {
        g = Function(code)
    } catch (e) {}
    g()
}
f("\
    Object.defineProperty(this,\"x\",{\
        get: function(){\
            evaluate(\"Array(x)\",{\
                newContext:true,\
                catchTermination:(function(){})\
            })\
        }\
    })\
");
f("x");
f(")");
f("x");

asserts js debug shell on m-c changeset 133348d717a1 without any CLI arguments at Assertion failure: obj == cacheResult, at jscompartment.h

Due to skipped revisions, the first bad revision could be any of:
changeset:   http://hg.mozilla.org/mozilla-central/rev/258f8cbfd428
parent:      143949:a0714b39a071
parent:      143913:d58fc624899c
user:        Ryan VanderMeulen
date:        Thu Aug 22 15:44:40 2013 -0400
summary:     Merge m-c to inbound.

changeset:   http://hg.mozilla.org/mozilla-central/rev/20c45ad8733b
user:        Gregory Szorc
date:        Thu Aug 22 12:48:18 2013 -0700
summary:     Bug 854611 - Notification Center notification when a long build completes; r=ted

changeset:   http://hg.mozilla.org/mozilla-central/rev/38510c5798ac
user:        Bobby Holley
date:        Thu Aug 22 12:54:05 2013 -0700
summary:     Bug 907937 - Followup fix for review-nit bustage. r=me CLOSED TREE

Bobby, bug 907937 isn't likely to be the right cause, is it?
Flags: needinfo?(bobbyholley+bmo)
(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #0)
> changeset:   http://hg.mozilla.org/mozilla-central/rev/38510c5798ac
> user:        Bobby Holley
> date:        Thu Aug 22 12:54:05 2013 -0700
> summary:     Bug 907937 - Followup fix for review-nit bustage. r=me CLOSED
> TREE
> 
> Bobby, bug 907937 isn't likely to be the right cause, is it?

That bug introduced this assertion, so it almost certainly is. I'll take a look.
Assignee: general → bobbyholley+bmo
Whiteboard: [jsbugmon:update] → [jsbugmon:]
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
(In reply to Christian Holler (:decoder) from comment #2)
> JSBugMon: Cannot process bug: Unable to automatically reproduce, please
> track manually.

I can't reproduce either - I get a 'too much recursion' error.
Flags: needinfo?(bobbyholley+bmo) → needinfo?(gary)
Hmmm, strange, this time I can't reproduce it either. Can we just land the testcase in case it comes back?

(sidenote, do you mind also landing the testcase for bug 909447 while you're at it?) :)
Flags: needinfo?(gary) → in-testsuite?
Flags: needinfo?(bobbyholley+bmo)

Comment 7

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/46345150fef4

Let's try this whole annotation thing again....

Comment 8

5 years ago
https://hg.mozilla.org/mozilla-central/rev/46345150fef4
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
Thanks! However, since the patch that supposedly fixes this is unknown, resolving WFM instead, and setting in-testsuite+.
Flags: in-testsuite? → in-testsuite+
Resolution: FIXED → WORKSFORME
You need to log in before you can comment on or make changes to this bug.