"Assertion failure: UPVAR_FRAME_SKIP(uva->vector[i]) == 1" with nested eval

RESOLVED FIXED in mozilla1.9.1b2

Status

()

Core
JavaScript Engine
P1
critical
RESOLVED FIXED
10 years ago
10 years ago

People

(Reporter: Jesse Ruderman, Assigned: brendan)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla1.9.1b2
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

10 years ago
(function(c){eval("eval('c.x')")})()

Assertion failure: UPVAR_FRAME_SKIP(uva->vector[i]) == 1, at jsopcode.cpp:2756

Tracemonkey branch, JIT does not have to be enabled.

Regression from bug 456692 or bug 461801, maybe?
(Assignee)

Comment 1

10 years ago
Bogus assertion left in wake of bug 456692, sorry about that. Patch anon.

/be
(Assignee)

Updated

10 years ago
Assignee: general → brendan
Blocks: 456692
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b2
(Assignee)

Comment 2

10 years ago
Created attachment 346082 [details] [diff] [review]
fix

I don't think it's worth trying to assert anything about the frame-skip half of the upvar cookie. Tell me if you disagree.

/be
Attachment #346082 - Flags: review?(mrbkap)

Updated

10 years ago
Attachment #346082 - Flags: review?(mrbkap) → review+
Comment on attachment 346082 [details] [diff] [review]
fix

All you'd be doing would be repeating the code in js_EmitTree, so I don't think it's worth it.

Updated

10 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED

Comment 5

10 years ago
test landed http://hg.mozilla.org/mozilla-central/rev/6d5b8d6012f3 and cvs
Flags: in-testsuite+
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.