1067805 - Assertion failure: !IsUninitializedLexical(val), at vm/Interpreter.cpp or Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    let x = (function() {
        return x
    }());
}());

asserts js debug shell on m-c changeset 3b7921328fc1 without any CLI flags at Assertion failure: !IsUninitializedLexical(val), at vm/Interpreter.cpp.

If run with --ion-eager --no-threads, the assertion mutates to Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h.

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/7027efe7fae3
user:        Shu-yu Guo
date:        Mon Sep 15 16:30:45 2014 -0700
summary:     Bug 1001090 - Part 1: Implement let temporal dead zone in the frontend and interpreter. (r=Waldo)

Shu-yu, is bug 1001090 a possible regressor?

Comment 1

[Shu-yu Guo [:shu]]

wtf, I had fixed this but pushed a wrong version without the fix (!) Will fix shortly.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacks

Comment 4

[Shu-yu Guo [:shu]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/ba2fd2f25d4e

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This landed on m-c:

http://hg.mozilla.org/mozilla-central/rev/ba2fd2f25d4e

Comment 6

[Ryan VanderMeulen [:RyanVM]]

FWIW, issues like comment 5 are due to bug 1062305. You can work around the bug by making sure you properly assign the bug when you land the patch on inbound. We try to double-check after running mcMerge, but as it's a manual process, it's error-prone as this bug shows. Thanks!