Closed
Bug 910929
Opened 13 years ago
Closed 12 years ago
Assertion failure: pt && pt->associatedWith(zone->runtime_), at vm/Runtime.cpp
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
| Tracking | Status | |
|---|---|---|
| firefox23 | --- | disabled |
| firefox24 | --- | disabled |
| firefox25 | --- | disabled |
| firefox26 | --- | affected |
| firefox-esr17 | --- | unaffected |
| b2g18 | --- | unaffected |
People
(Reporter: gkw, Unassigned)
Details
(4 keywords, Whiteboard: [jsbugmon:])
Attachments
(1 file)
|
21.55 KB,
text/plain
|
Details |
s = newGlobal()
function f(code) {
try {
evalcx(code, s)
} catch (e) {}
}
f("\
Object.defineProperty(this,\"v0\",{\
get:function(){\
return p2.t()\
}\
});\
Object.defineProperty(this,\"p2\",{\
get:function(){\
return ParallelArray([497],function(){})\
}\
});\
Object(v0);\
");
f("v0;");
f("(1 instanceof this);")
asserts js 64-bit debug shell intermittently on Windows 7 on m-c changeset dc7b76fcf7e4 (which contains the fix - rev d825964ccab6 for bug 903028) with --ion-eager --ion-parallel-compile=on at Assertion failure: pt && pt->associatedWith(zone->runtime_), at vm/Runtime.cpp
Shu-yu, you fixed bug 903028, perhaps these are related? (Setting s-s because that bug is also s-s.
My configure flags are:
--host=x86_64-pc-mingw32 --target=x86_64-pc-mingw32 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-threadsafe <NSPR flags, e.g. --with-system-nspr>
Flags: needinfo?(shu)
| Reporter | ||
Updated•13 years ago
|
Attachment #797526 -
Attachment description: out.txt → Stack
| Reporter | ||
Comment 1•13 years ago
|
||
Likely a regression from ParallelArrays, setting status flags to be similar to bug 903028.
status-b2g18:
--- → unaffected
status-firefox23:
--- → disabled
status-firefox24:
--- → disabled
status-firefox25:
--- → disabled
status-firefox26:
--- → affected
status-firefox-esr17:
--- → unaffected
Comment 2•12 years ago
|
||
Pre-CritSmash triage, setting sec-high as per related bug.
Keywords: sec-high
Comment 3•12 years ago
|
||
Gary does this still reproduce for you?
Flags: needinfo?(gary)
Whiteboard: [jsbugmon:update,reconfirm]
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,reconfirm] → [jsbugmon:reconfirm]
Comment 4•12 years ago
|
||
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
Comment 5•12 years ago
|
||
I can't reproduce this. Could I be re-needinfo?d if it reproduces?
Flags: needinfo?(shu)
| Reporter | ||
Comment 6•12 years ago
|
||
(In reply to Shu-yu Guo [:shu] from comment #5)
> I can't reproduce this. Could I be re-needinfo?d if it reproduces?
Do you mind testing on the specified rev on Windows 7? I'd need to retest too, but I'll be at a conference for the next few days and I'm still digging through bugmail.
Flags: needinfo?(gary) → needinfo?(shu)
Whiteboard: [jsbugmon:reconfirm] → [jsbugmon:]
| Reporter | ||
Comment 7•12 years ago
|
||
I can't reproduce this with m-c rev 34f431863037 anymore, nor can I reproduce with original rev in comment 0. -> WFM
Status: NEW → RESOLVED
Closed: 12 years ago
Flags: needinfo?(shu) → in-testsuite?
Resolution: --- → WORKSFORME
Updated•11 years ago
|
Group: core-security → core-security-release
Updated•8 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•