909441 - Assertion failure: obj == cacheResult, at jscompartment.h

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function f(code) {
    try {
        g = Function(code)
    } catch (e) {}
    g()
}
f("\
    Object.defineProperty(this,\"x\",{\
        get: function(){\
            evaluate(\"Array(x)\",{\
                newContext:true,\
                catchTermination:(function(){})\
            })\
        }\
    })\
");
f("x");
f(")");
f("x");

asserts js debug shell on m-c changeset 133348d717a1 without any CLI arguments at Assertion failure: obj == cacheResult, at jscompartment.h

Due to skipped revisions, the first bad revision could be any of:
changeset:   http://hg.mozilla.org/mozilla-central/rev/258f8cbfd428
parent:      143949:a0714b39a071
parent:      143913:d58fc624899c
user:        Ryan VanderMeulen
date:        Thu Aug 22 15:44:40 2013 -0400
summary:     Merge m-c to inbound.

changeset:   http://hg.mozilla.org/mozilla-central/rev/20c45ad8733b
user:        Gregory Szorc
date:        Thu Aug 22 12:48:18 2013 -0700
summary:     Bug 854611 - Notification Center notification when a long build completes; r=ted

changeset:   http://hg.mozilla.org/mozilla-central/rev/38510c5798ac
user:        Bobby Holley
date:        Thu Aug 22 12:54:05 2013 -0700
summary:     Bug 907937 - Followup fix for review-nit bustage. r=me CLOSED TREE

Bobby, bug 907937 isn't likely to be the right cause, is it?

Comment 1

[Bobby Holley (:bholley)]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #0)
> changeset:   http://hg.mozilla.org/mozilla-central/rev/38510c5798ac
> user:        Bobby Holley
> date:        Thu Aug 22 12:54:05 2013 -0700
> summary:     Bug 907937 - Followup fix for review-nit bustage. r=me CLOSED
> TREE
> 
> Bobby, bug 907937 isn't likely to be the right cause, is it?

That bug introduced this assertion, so it almost certainly is. I'll take a look.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 3

[Bobby Holley (:bholley)]

(In reply to Christian Holler (:decoder) from comment #2)
> JSBugMon: Cannot process bug: Unable to automatically reproduce, please
> track manually.

I can't reproduce either - I get a 'too much recursion' error.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Hmmm, strange, this time I can't reproduce it either. Can we just land the testcase in case it comes back?

(sidenote, do you mind also landing the testcase for bug 909447 while you're at it?) :)

Comment 5

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b1b242a80ef7

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Backed out.
https://hg.mozilla.org/integration/mozilla-inbound/rev/b2e8b8887816

Comment 7

[Eric Faust [:efaust]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/46345150fef4

Let's try this whole annotation thing again....

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/46345150fef4

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Thanks! However, since the patch that supposedly fixes this is unknown, resolving WFM instead, and setting in-testsuite+.