Assertion failure: !(*this)->aliased(), at jsscript.h

RESOLVED FIXED in mozilla36

Status

()

Product:
Core
Component:
JavaScript Engine
Importance:
--
critical
Status:
RESOLVED FIXED
Reported:
4 years ago
Modified:
4 years ago

People

(Reporter: gkw, Assigned: jandem)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Version:
Trunk
Target:
mozilla36
Platform:
x86_64
Mac OS X
Keywords:
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox36 affected)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

Patch
1.29 KB, patch
shu
: review+
Details | Diff | Splinter Review
(Reporter)

Description

•
4 years ago 
(function() {
    let x = let(z = function() {}) x
    function f(y = f) {}
})()

asserts js debug shell on m-c changeset 80e18ff7c7b2 with --no-ion --no-threads at Assertion failure: !(*this)->aliased(), at jsscript.h.

Debug configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/75de7e0fe086
user:        Jan de Mooij
date:        Wed Oct 29 13:49:20 2014 +0100
summary:     Bug 1090491 - Don't allocate stack slots for aliased locals. r=luke

Jan, is bug 1090491 a possible regressor?
Flags: needinfo?(jdemooij)
(Assignee)

Comment 1

•
4 years ago 
Created attachment 8514565 [details] [diff] [review]
Patch

ReportUninitializedLexical calls bi.frameIndex(), but that's no longer valid for aliased locals. In this case we know the binding we're looking for is not aliased, so we can just check for that.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8514565 - Flags: review?(shu)

Updated

•
4 years ago
Attachment #8514565 - Flags: review?(shu) → review+

Comment 3

•
4 years ago 
https://hg.mozilla.org/mozilla-central/rev/ef9ed51f78e0
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla36
You need to log in before you can comment on or make changes to this bug.