Closed Bug 1073702 Opened 6 years ago Closed 6 years ago

Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h

Categories

(Core :: JavaScript Engine: JIT, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla35
Tracking Status
firefox35 --- fixed

People

(Reporter: gkw, Assigned: shu)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

try {
    let x = ((function f(y) {
        if (y > 0) {
            f(-1)
        }
        x
    })(1))
} catch (e) {}

asserts js debug shell on m-c changeset 16ff803b47a9 with --ion-eager --no-threads at Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h.

Debug configure flags:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

=== Tinderbox Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20140915155135" and the hash "170ce237e4a0".
The "bad" changeset has the timestamp "20140915164436" and the hash "b7f4709b34c3".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=170ce237e4a0&tochange=b7f4709b34c3

Shu-yu, is bug 1001090 a possible regressor? (Assuming related to the let changes)
Flags: needinfo?(shu)
Flags: needinfo?(shu)
Comment on attachment 8496371 [details] [diff] [review]
Check for uninitialized lexical bindings in FetchName and friends.

Review of attachment 8496371 [details] [diff] [review]:
-----------------------------------------------------------------

Can you add the testcase?
Attachment #8496371 - Flags: review?(jdemooij) → review+
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 835ef55e175e).
http://hg.mozilla.org/mozilla-central/rev/992946f2286a
Assignee: nobody → shu
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update]
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.