Closed
Bug 806522
Opened 12 years ago
Closed 11 years ago
"Assertion failure: getSlot(EVAL).isObject()," or Assertion failure: getSlotRefForCompilation(EVAL).isObject(), at js/src/vm/GlobalObject.h
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla28
People
(Reporter: gkw, Assigned: jorendorff)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(2 files)
|
(deleted),
text/plain
|
Details | |
|
(deleted),
patch
|
Waldo
:
review+
|
Details | Diff | Splinter Review |
evalcx("\
let(eval) {\
eval()\
}\
", evalcx('lazy'))
asserts js debug shell on m-c changeset 3fb7c935a625 with --no-jm --no-ion --no-ti at Assertion failure: getSlot(EVAL).isObject(),
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 79157:d6f9285f623e
user: Igor Bukanov
date: Thu Sep 22 12:08:55 2011 +0200
summary: bug 684529 - remove script object. r=jorendorff
|
Assignee | |
Comment 1•12 years ago
|
||
evalcx("let(eval) {eval()}", evalcx('lazy'))
Assignee: general → jorendorff
|
|
Assignee | |
Comment 2•12 years ago
|
||
This happens when we hit JSOP_EVAL without having resolved global.eval yet.
I'm not sure there's any danger in release builds. I'll write a fix tomorrow.
var g = evalcx("lazy");
evaluate("let(eval) {eval()}", {global: g});
|
Reporter | |
Comment 3•12 years ago
|
||
(In reply to Jason Orendorff [:jorendorff] from comment #2)
> This happens when we hit JSOP_EVAL without having resolved global.eval yet.
>
> I'm not sure there's any danger in release builds. I'll write a fix tomorrow.
jorendorff, was there any movement on this front or did it slip off your radar?
Flags: needinfo?(jorendorff)
|
|
Reporter | |
Comment 4•12 years ago
|
||
(In reply to Jason Orendorff [:jorendorff] from comment #2)
> This happens when we hit JSOP_EVAL without having resolved global.eval yet.
>
> I'm not sure there's any danger in release builds. I'll write a fix tomorrow.
jorendorff, was there any movement on this front or did it slip off your radar?
|
||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:]
|
|
||
Comment 5•12 years ago
|
||
JSBugMon: Cannot process bug: Unknown exception (check manually)
|
|
Reporter | |
Comment 6•12 years ago
|
||
Let's try to see if JSBugMon can handle this again. (I can still repro this on a recent m-c build locally)
Whiteboard: [jsbugmon:] → [jsbugmon:update,reconfirm]
|
|
||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,reconfirm] → [jsbugmon:update,reconfirm,ignore]
|
|
||
Comment 7•12 years ago
|
||
JSBugMon: This bug has been automatically confirmed to be still valid (reproduced on revision e7632ab657e5).
|
|
Reporter | |
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,reconfirm,ignore] → [jsbugmon:update]
|
|
Assignee | |
Comment 8•11 years ago
|
||
Attachment #8338657 -
Flags: review?(jwalden+bmo)
Flags: needinfo?(jorendorff)
|
||
Comment 9•11 years ago
|
||
Comment on attachment 8338657 [details] [diff] [review]
bug-806522-eval-v1.patch
Review of attachment 8338657 [details] [diff] [review]:
-----------------------------------------------------------------
This is actually kinda prettier than it used to be! That, or my sense of taste is going.
Attachment #8338657 -
Flags: review?(jwalden+bmo) → review+
|
|
Reporter | |
Comment 10•11 years ago
|
||
Just coming around to help land this, and fix the long-time fuzz bug:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f6114308c97d
Target Milestone: --- → mozilla28
|
|
Reporter | |
Updated•11 years ago
|
Flags: in-testsuite+
|
|
Reporter | |
Comment 11•11 years ago
|
||
This had recently morphed to:
Assertion failure: getSlotRefForCompilation(EVAL).isObject(), at js/src/vm/GlobalObject.h
Summary: "Assertion failure: getSlot(EVAL).isObject()," → "Assertion failure: getSlot(EVAL).isObject()," or Assertion failure: getSlotRefForCompilation(EVAL).isObject(), at js/src/vm/GlobalObject.h
|
||
Comment 12•11 years ago
|
||
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
|
||
Comment 13•11 years ago
|
||
This shouldn't be "verifyme" since it's in-testsuite+... my bad
Keywords: verifyme
You need to log in
before you can comment on or make changes to this bug.
Description
•