1235477 - Assertion failure: stub->monitorsThis() || *GetNextPc(pc) == JSOP_CHECKTHIS || *GetNextPc(pc) == JSOP_CHECKRETURN, at js/src/jit/SharedIC.cpp:4737

Status: RESOLVED DUPLICATE of bug 1234717

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 7c83da46ea74 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

(function() {
    {
        let x = f();
        function f() {
            x;
        }
    }
})()

Backtrace:

0   js-dbg-64-dm-darwin-7c83da46ea74	0x00000001003e2b6c js::jit::DoTypeMonitorFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICTypeMonitor_Fallback*, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) + 1980 (SharedIC.cpp:4735)
1   ???                           	0x0000000103f03f57 0 + 4361043799

The patch in bug 1234164 comment 4 fixes the issue in that bug but does not fix this one.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/73c94ff300b2
user:        Shu-yu Guo
date:        Wed Dec 09 07:52:58 2015 -0800
summary:     Bug 1071646 - Make functions block-scoped in JS and implement Annex B semantics for compatibility. (r=jorendorff)

Shu-yu, is bug 1071646 a likely regressor?

Comment 2

[Shu-yu Guo [:shu]]

I'm pretty sure this is a dup of bug 1234164.