472454 - TM: Crash [@ js_CheckRedeclaration]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

this.__defineSetter__("x", Math.pow);
window = x;
for (var a = 0; a < 2; ++a) {
  let (y = false) { do {for each (let x in [false, '']) {} } while([x = window].map(function(){})); }  
}

crashes opt near null at js_CheckRedeclaration and asserts dbg at:

Assertion failure: !JSVAL_IS_PRIMITIVE(lval), at ../jsinterp.cpp:6216

Seems to be TM-only.

Comment 1

[Graydon Hoare :graydon]

Cannot reproduce. Is this in shell or browser? Build id / revid? Tracemonkey revs from your reporting date (and many dates nearby -- a month ago, the present) don't seem to display it, in shell.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #1)
> Cannot reproduce. Is this in shell or browser? Build id / revid? Tracemonkey
> revs from your reporting date (and many dates nearby -- a month ago, the
> present) don't seem to display it, in shell.

I now get a hang in both debug and opt trunk js shell, with and without -j. I'm not sure if this is working as expected.

Comment 3

[Jesse Ruderman]

I think hanging is the expected behavior:

[x = window].map(function(){})

is an array, which is truthy for the do..while loop (because an array is an object).