Closed Bug 910929 Opened 11 years ago Closed 11 years ago

Assertion failure: pt && pt->associatedWith(zone->runtime_), at vm/Runtime.cpp

Categories

(Core :: JavaScript Engine, defect)

x86_64
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox23 --- disabled
firefox24 --- disabled
firefox25 --- disabled
firefox26 --- affected
firefox-esr17 --- unaffected
b2g18 --- unaffected

People

(Reporter: gkw, Unassigned)

Details

(4 keywords, Whiteboard: [jsbugmon:])

Attachments

(1 file)

Attached file Stack
s = newGlobal()
function f(code) {
    try {
        evalcx(code, s)
    } catch (e) {}
}
f("\
    Object.defineProperty(this,\"v0\",{\
        get:function(){\
            return p2.t()\
        }\
    });\
    Object.defineProperty(this,\"p2\",{\
        get:function(){\
            return ParallelArray([497],function(){})\
        }\
    });\
    Object(v0);\
");
f("v0;");
f("(1 instanceof this);")

asserts js 64-bit debug shell intermittently on Windows 7 on m-c changeset dc7b76fcf7e4 (which contains the fix - rev d825964ccab6 for bug 903028) with --ion-eager --ion-parallel-compile=on at Assertion failure: pt && pt->associatedWith(zone->runtime_), at vm/Runtime.cpp

Shu-yu, you fixed bug 903028, perhaps these are related? (Setting s-s because that bug is also s-s.

My configure flags are:
--host=x86_64-pc-mingw32 --target=x86_64-pc-mingw32 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-threadsafe <NSPR flags, e.g. --with-system-nspr>
Flags: needinfo?(shu)
Attachment #797526 - Attachment description: out.txt → Stack
Likely a regression from ParallelArrays, setting status flags to be similar to bug 903028.
Pre-CritSmash triage, setting sec-high as per related bug.
Keywords: sec-high
Gary does this still reproduce for you?
Flags: needinfo?(gary)
Whiteboard: [jsbugmon:update,reconfirm]
Whiteboard: [jsbugmon:update,reconfirm] → [jsbugmon:reconfirm]
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
I can't reproduce this. Could I be re-needinfo?d if it reproduces?
Flags: needinfo?(shu)
(In reply to Shu-yu Guo [:shu] from comment #5)
> I can't reproduce this. Could I be re-needinfo?d if it reproduces?

Do you mind testing on the specified rev on Windows 7? I'd need to retest too, but I'll be at a conference for the next few days and I'm still digging through bugmail.
Flags: needinfo?(gary) → needinfo?(shu)
Whiteboard: [jsbugmon:reconfirm] → [jsbugmon:]
I can't reproduce this with m-c rev 34f431863037 anymore, nor can I reproduce with original rev in comment 0. -> WFM
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: needinfo?(shu) → in-testsuite?
Resolution: --- → WORKSFORME
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: