1091757 - Assertion failure: !(*this)->aliased(), at jsscript.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    let x = let(z = function() {}) x
    function f(y = f) {}
})()

asserts js debug shell on m-c changeset 80e18ff7c7b2 with --no-ion --no-threads at Assertion failure: !(*this)->aliased(), at jsscript.h.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/75de7e0fe086
user:        Jan de Mooij
date:        Wed Oct 29 13:49:20 2014 +0100
summary:     Bug 1090491 - Don't allocate stack slots for aliased locals. r=luke

Jan, is bug 1090491 a possible regressor?

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

ReportUninitializedLexical calls bi.frameIndex(), but that's no longer valid for aliased locals. In this case we know the binding we're looking for is not aliased, so we can just check for that.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ef9ed51f78e0

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ef9ed51f78e0