Closed
Bug 727921
Opened 13 years ago
Closed 13 years ago
"Assertion failure: (ptrBits & 0x7) == 0,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
VERIFIED
FIXED
mozilla13
Tracking | Status | |
---|---|---|
firefox12 | --- | unaffected |
firefox13 | --- | fixed |
firefox-esr10 | --- | unaffected |
People
(Reporter: gkw, Assigned: billm)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [sg:critical] js-triage-needed [advisory-tracking+])
Attachments
(1 file)
(deleted),
text/plain
|
Details |
(function() {
let(d) {
yield
}
})()
eval("\
(function(){\
schedulegc(5), 'a'.replace(/a/,function(){yield})\
})\
")()
asserts js debug shell on m-c changeset ebafee0cea36 with -m, -a and -n at Assertion failure: (ptrBits & 0x7) == 0,
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 86695:fbef6a165cf8
user: Bill McCloskey
date: Fri Feb 10 18:32:08 2012 -0800
summary: Bug 723313 - Stop using conservative stack scanner for VM stack marking (r=luke,bhackett)
Reporter | ||
Updated•13 years ago
|
Group: core-security
Reporter | ||
Comment 1•13 years ago
|
||
Assuming sg:critical and s-s initially after a quick look by billm and I.
Whiteboard: js-triage-needed → [sg:critical] js-triage-needed
Reporter | ||
Comment 2•13 years ago
|
||
Erm, I updated to tip and this seems gone, probably fixed by bug 714109:
autoBisect shows this is probably related to the following changeset:
The first good revision is:
changeset: 86735:f29587aa8965
user: Terrence Cole
date: Mon Feb 13 10:01:18 2012 -0800
summary: Bug 714109 - Add missing barriers to Generator; r=billm
Status: NEW → RESOLVED
Closed: 13 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Assignee | ||
Comment 3•13 years ago
|
||
I'm going to re-open this, at least until I can triage it. Bug 714109 wasn't intended to fix existing bugs in the tree, so it's more likely that it's just covering up the problem.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Assignee | ||
Comment 4•13 years ago
|
||
OK, it turns out I was wrong. That patch actually does fix the problem. I pushed a test case here:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4079180d600c
Status: REOPENED → RESOLVED
Closed: 13 years ago → 13 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 5•13 years ago
|
||
> https://hg.mozilla.org/integration/mozilla-inbound/rev/4079180d600c
Setting in-testsuite+
Flags: in-testsuite? → in-testsuite+
Comment 6•13 years ago
|
||
(Normally bugs aren't closed until the cset merges from inbound)
https://hg.mozilla.org/mozilla-central/rev/4079180d600c
Followup: https://hg.mozilla.org/mozilla-central/rev/d16c61316cf4
Assignee: general → wmccloskey
Target Milestone: --- → mozilla13
Updated•13 years ago
|
status-firefox13:
--- → fixed
Updated•13 years ago
|
Reporter | ||
Comment 7•13 years ago
|
||
Test committed with fix, marking verified based on that.
Status: RESOLVED → VERIFIED
Updated•13 years ago
|
Whiteboard: [sg:critical] js-triage-needed → [sg:critical] js-triage-needed [advisory-tracking+]
You need to log in
before you can comment on or make changes to this bug.
Description
•