472528 - TM: "Assertion failure: !js_IsActiveWithOrBlock(cx, fp->scopeChain, 0), at ../jsinterp.cpp" or "Assertion failure: !fp->blockChain, at ../jsinterp.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (var i = 0; i < 4; ++i) {
 for (let j = 0; j < 2; ++j) { }
 let (x) (function(){});
}

asserts dbg at Assertion failure: !js_IsActiveWithOrBlock(cx, fp->scopeChain, 0), at ../jsinterp.cpp:7075 while a variant,

for (let i = 0; i < 4; ++i) {
 for (let j = 0; j < 2; ++j) { }
 let (x) (function(){});
}

asserts dbg TM at Assertion failure: !fp->blockChain, at ../jsinterp.cpp:6686

Thanks Jesse for helping to reduce this testcase. Both seem harmless in opt. Nominating due to their simplicity -- they merely involve two nested for loops (besides let/var functions).

Comment 1

[Brendan Eich [:brendan]]

Closures, even ones that do not look at upvars, should depend on bug 452498 for now. I will test and update when the patch for that bug is ready. If you see a crash involving scope or block chain reification assertions, it's a candidate. Setting bug 452498 as the blocker means I won't miss it.

/be

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows both the testcases in comment #0 were fixed by
http://hg.mozilla.org/tracemonkey/rev/74416c7004c5 :

changeset:   26137:74416c7004c5
user:        Jim Blandy
date:        Mon Mar 16 09:55:06 2009 -0700
summary:     Bug 480132: Clone lexical blocks only when needed. r=igor

Comment 4

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/tracemonkey/rev/1b44c877f838

/cvsroot/mozilla/js/tests/js1_8/regress/regress-472528-01.js,v  <--  regress-472528-01.js
initial revision: 1.1
/cvsroot/mozilla/js/tests/js1_8/regress/regress-472528-02.js,v  <--  regress-472528-02.js
initial revision: 1.1

Comment 5

[Robert Sayre]

bug 480132 is fixed1.9.1, so this is fixed1.9.1

Comment 6

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Verified fixed with testcases in comment 0 with the following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090522 Minefield/3.6a1pre ID:20090522133810

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre)
Gecko/20090522 Shiretoko/3.5pre ID:20090522153422