353079 - "Assertion failure: op == JSOP_LEAVEBLOCKEXPR ? ..." with WAY_TOO_MUCH_GC

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

This is with "prep patch for plan A, v7b" from bug 346642.  You must have WAY_TOO_MUCH_GC enabled to see the bug.

js> for (let a in [1]) let (x) { for(let y in ((function(id2) { return id2; })( '' ))) { } }

Assertion failure: op == JSOP_LEAVEBLOCKEXPR ? fp->spbase + OBJ_BLOCK_DEPTH(cx, obj) == sp - 1 : fp->spbase + OBJ_BLOCK_DEPTH(cx, obj) == sp, at jsinterp.c:6031

Comment 1

[Brendan Eich [:brendan]]

I've diagnosed this, Igor is on it.  Should fix for 1.8.1.

/be

Comment 2

[Igor Bukanov]

Attachment: Fix v1

The fix. It is the minimal version since it also moved parent checks, but it is easy to comment what is going on in this way.

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 241501 [details] [diff] [review]
Fix v1

r=me, please land ASAP.  The branch will need a different patch without JS_PUSH_TEMP_ROOT_OBJECT.

/be

Comment 4

[Igor Bukanov]

Attachment: Fix v2

A patch to commit that does not use the object form of tvr root to saty compatible with 1.8.1 branch.

Comment 5

[Igor Bukanov]

I committed the patch from comment 4 to the trunk:

Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.297; previous revision: 3.296
done

Comment 6

[Bob Clary [:bc] (inactive)]

Attachment: js1_7/regress/regress-353079.js

Comment 7

[Mike Schroepfer]

Comment on attachment 241510 [details] [diff] [review]
Fix v2

Approved for RC3.

Comment 8

[Igor Bukanov]

I committed the patch from comment 4 to MOZILLA_1_8_BRANCH:

Checking in jsinterp.c;
/cvsroot/mozilla/js/src/jsinterp.c,v  <--  jsinterp.c
new revision: 3.181.2.68; previous revision: 3.181.2.67
done

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 20061011 dbg way too much gc builds on windows/macppc/linux

Comment 10

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20061121 windows/linux

Comment 11

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_7/regress/regress-353079.js,v  <--  regress-353079.js