Carsten Book [:Tomcat] Reporter
	Description • 16 years ago

Found during the automated TopSite Test on http://www.sauto.cz/ 

http://www.sauto.cz/ cause a Assertion failure: Assertion failure: JSVAL_TAG(v) == JSVAL_STRING, at /work/mozilla/builds/1.9.1-tracemonkey/mozilla/js/src/jstracer.cpp:1582

	Jesse Ruderman
	Comment 2 • 16 years ago

Moved to the shell (just had to remove the <script> tags) and removed a few empty blocks and functions.  Now 28 lines.

	Jesse Ruderman
	Comment 3 • 16 years ago

A little simpler: made some variables local, killed shadowing (!!) in loadAds.

	Jesse Ruderman
	Comment 4 • 16 years ago

Can't reduce it much more than this.

	Jesse Ruderman
	Comment 5 • 16 years ago

Btw, this assertion also shows up in bug 475658.

	Andreas Gal :gal Assignee
	Comment 6 • 16 years ago

Confirmed.

	Carsten Book [:Tomcat] Reporter
	Comment 7 • 16 years ago

Note this is not fixed by Bug 475916 - i still see this with a TM tip build

	Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)
	Comment 8 • 16 years ago

(In reply to comment #4)
> Created an attachment (id=359861) [details]
> shell testcase, 9 lines
> 
> Can't reduce it much more than this.

This testcase seems to WFM in TM js shell (with and without -j), would like more confirmation before resolution.

	Robert Sayre
	Comment 9 • 16 years ago

(In reply to comment #7)
> Note this is not fixed by Bug 475916 - i still see this with a TM tip build

This WFM as well. Tomcat, can you still reproduce it?

	Robert Sayre
	Comment 10 • 16 years ago

Gary, can you use the auto bisecter to determine which changeset fixed this?

	Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)
	Comment 11 • 16 years ago

(In reply to comment #10)
> Gary, can you use the auto bisecter to determine which changeset fixed this?

autoBisect shows bug 476653 is likely to have fixed this.

changeset:   25401:0d0489b3e4b7
user:        David Anderson
date:        Tue Feb 24 22:52:09 2009 -0500
summary:     Fixed breakage of type stability guarantees between linked trees, and fixed using the wrong global typemap in LeaveTree (bug 476653, r=gal).

I've not yet manually verified this though.

	Bob Clary [:bc] (inactive)
	Comment 12 • 16 years ago

http://hg.mozilla.org/tracemonkey/rev/488f2529b447
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-476192.js,v  <--  regress-476192.js
initial revision: 1.1

	Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)
	Comment 13 • 16 years ago

(In reply to comment #11)
> (In reply to comment #10)
> > Gary, can you use the auto bisecter to determine which changeset fixed this?
> 
> autoBisect shows bug 476653 is likely to have fixed this.
> 
> changeset:   25401:0d0489b3e4b7
> user:        David Anderson
> date:        Tue Feb 24 22:52:09 2009 -0500
> summary:     Fixed breakage of type stability guarantees between linked trees,
> and fixed using the wrong global typemap in LeaveTree (bug 476653, r=gal).
> 
> I've not yet manually verified this though.

I have manually verified that the fix in bug 476653 does indeed fix this issue as well.

	Robert Sayre
	Comment 14 • 16 years ago

 Bug 476653 is fixed1.9.1, so this is too.

	Bob Clary [:bc] (inactive)
	Comment 15 • 16 years ago

v 1.9.1, 1.9.2

	Bob Clary [:bc] (inactive)
	Comment 16 • 15 years ago

fix summary to not include string 'Assertion fail'
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-476192.js,v  <--  regress-476192.js
new revision: 1.2; previous revision: 1.1