1084194 - Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h

Status: RESOLVED DUPLICATE of bug 1077949

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    switch (0) {
        case 1:
            let eval;
        case (function() {
            return eval
        })():
    }
}())

asserts js debug shell on m-c changeset a280a03c9f3c with --ion-eager --no-threads at Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/7027efe7fae3
user:        Shu-yu Guo
date:        Mon Sep 15 16:30:45 2014 -0700
summary:     Bug 1001090 - Part 1: Implement let temporal dead zone in the frontend and interpreter. (r=Waldo)

Shu-yu, is bug 1001090 a possible regressor?

Comment 1

[Jeff Walden [:Waldo]]

Scumbag eval.

(Yes.)

Comment 2

[Jeff Walden [:Waldo]]

Or, no.  Just a dup, fuzzers complaining because testing a too-old revision.