Closed Bug 1091757 Opened 7 years ago Closed 7 years ago

Assertion failure: !(*this)->aliased(), at jsscript.h

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla36
Tracking Status
firefox36 --- affected

People

(Reporter: gkw, Assigned: jandem)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(1 file)

(function() {
    let x = let(z = function() {}) x
    function f(y = f) {}
})()

asserts js debug shell on m-c changeset 80e18ff7c7b2 with --no-ion --no-threads at Assertion failure: !(*this)->aliased(), at jsscript.h.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/75de7e0fe086
user:        Jan de Mooij
date:        Wed Oct 29 13:49:20 2014 +0100
summary:     Bug 1090491 - Don't allocate stack slots for aliased locals. r=luke

Jan, is bug 1090491 a possible regressor?
Flags: needinfo?(jdemooij)
Attached patch PatchSplinter Review
ReportUninitializedLexical calls bi.frameIndex(), but that's no longer valid for aliased locals. In this case we know the binding we're looking for is not aliased, so we can just check for that.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8514565 - Flags: review?(shu)
Attachment #8514565 - Flags: review?(shu) → review+
https://hg.mozilla.org/mozilla-central/rev/ef9ed51f78e0
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla36
You need to log in before you can comment on or make changes to this bug.