TM: "Assertion failure: !js_IsActiveWithOrBlock(cx, fp->scopeChain, 0), at ../jsinterp.cpp" or "Assertion failure: !fp->blockChain, at ../jsinterp.cpp"

VERIFIED FIXED in mozilla1.9.2a1

Status

()

defect
P2
critical
VERIFIED FIXED
11 years ago
10 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks 1 bug, {assertion, testcase, verified1.9.1})

Trunk
mozilla1.9.2a1
x86
macOS
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9.1 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

for (var i = 0; i < 4; ++i) {
 for (let j = 0; j < 2; ++j) { }
 let (x) (function(){});
}

asserts dbg at Assertion failure: !js_IsActiveWithOrBlock(cx, fp->scopeChain, 0), at ../jsinterp.cpp:7075 while a variant,

for (let i = 0; i < 4; ++i) {
 for (let j = 0; j < 2; ++j) { }
 let (x) (function(){});
}

asserts dbg TM at Assertion failure: !fp->blockChain, at ../jsinterp.cpp:6686

Thanks Jesse for helping to reduce this testcase. Both seem harmless in opt. Nominating due to their simplicity -- they merely involve two nested for loops (besides let/var functions).
Flags: blocking1.9.1?
Closures, even ones that do not look at upvars, should depend on bug 452498 for now. I will test and update when the patch for that bug is ready. If you see a crash involving scope or block chain reification assertions, it's a candidate. Setting bug 452498 as the blocker means I won't miss it.

/be
Depends on: upvar2
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2
Duplicate of this bug: 469237
autoBisect shows both the testcases in comment #0 were fixed by
http://hg.mozilla.org/tracemonkey/rev/74416c7004c5 :

changeset:   26137:74416c7004c5
user:        Jim Blandy
date:        Mon Mar 16 09:55:06 2009 -0700
summary:     Bug 480132: Clone lexical blocks only when needed. r=igor
Status: NEW → RESOLVED
Closed: 11 years ago
Depends on: 480132
Resolution: --- → FIXED
http://hg.mozilla.org/tracemonkey/rev/1b44c877f838

/cvsroot/mozilla/js/tests/js1_8/regress/regress-472528-01.js,v  <--  regress-472528-01.js
initial revision: 1.1
/cvsroot/mozilla/js/tests/js1_8/regress/regress-472528-02.js,v  <--  regress-472528-02.js
initial revision: 1.1
Flags: in-testsuite+
bug 480132 is fixed1.9.1, so this is fixed1.9.1
Keywords: fixed1.9.1
Verified fixed with testcases in comment 0 with the following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090522 Minefield/3.6a1pre ID:20090522133810

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre)
Gecko/20090522 Shiretoko/3.5pre ID:20090522153422
Status: RESOLVED → VERIFIED
Target Milestone: --- → mozilla1.9.2a1
You need to log in before you can comment on or make changes to this bug.