"Assertion failure: sprop->parent == scope->lastProp"

VERIFIED FIXED in mozilla1.9beta4

Status

()

Core
JavaScript Engine
P1
major
VERIFIED FIXED
10 years ago
10 years ago

People

(Reporter: Jesse Ruderman, Assigned: brendan)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla1.9beta4
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9 +
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

10 years ago
js> for (var i=0; i<2; ++i) ({ p: 5, p: 7 });
Assertion failure: sprop->parent == scope->lastProp, at jsinterp.c:5946

This is a recent regression.  I'm guessing it's a regression from bug 129496, since the assertion was added there.

I convinced myself that this seems harmless in opt builds using a slightly more complicated script that checks the constructed objects.  In opt builds, it outputs "({p:7})" twice; in debug builds, it outputs "({p:7})" once and then asserts.

function g() { for (var i=0; i<2; ++i) yield ({ p: 5, p: 7 }); }
var iter = g();
print(uneval(iter.next()));
print(uneval(iter.next()));
(Assignee)

Comment 1

10 years ago
Easy to fix, benign (a strict warning). Must fix assertions pronto.

/be
Assignee: general → brendan
Flags: blocking1.9+
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9beta4
(Assignee)

Updated

10 years ago
Status: NEW → ASSIGNED
(Assignee)

Comment 2

10 years ago
Created attachment 305962 [details] [diff] [review]
take the slow path if we detect a dup
Attachment #305962 - Flags: review?(shaver)
Comment on attachment 305962 [details] [diff] [review]
take the slow path if we detect a dup

r=shaver
Attachment #305962 - Flags: review?(shaver) → review+
(Assignee)

Comment 4

10 years ago
Comment on attachment 305962 [details] [diff] [review]
take the slow path if we detect a dup

There may be more bad here, need to write a test. But we don't need the assertbotch in b4.

/be
Attachment #305962 - Flags: approval1.9b4?
Attachment #305962 - Flags: approval1.9+
Comment on attachment 305962 [details] [diff] [review]
take the slow path if we detect a dup

a1.9b4=beltzner
Attachment #305962 - Flags: approval1.9b4? → approval1.9b4+
(Assignee)

Comment 6

10 years ago
Fixed:

js/src/jsinterp.c 3.447

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED

Comment 7

10 years ago
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-419803.js,v  <--  regress-419803.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_7/regress/regress-419803.js,v  <--  regress-419803.js
initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-

Comment 8

10 years ago
v
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.