483749 - TM: "Assertion failure: !js_IsActiveWithOrBlock(cx, fp->scopeChain, 0), at ../jsinterp.cpp:7151" with |with|

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for each (let x in ['']) {
  for (var b = 0; b < 5; ++b) {
    if (b % 5 == 3) {
      with([]) this
    }
  }  
}


-- spun off from https://bugzilla.mozilla.org/show_bug.cgi?id=452498#c138 --

asserts debug TM with -j at Assertion failure: !js_IsActiveWithOrBlock(cx, fp->scopeChain, 0), at ../jsinterp.cpp:7151, and will not be fixed by upvar2 patch in bug 452498 since the testcase has no functions.

This bug is unlike bug 472528 which shows the same assertion, but will be fixed by upvar2.

Comment 1

[Mike Beltzner [:beltzner, not reading bugmail]]

Blocking for same reasons as 472528.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this was fixed by http://hg.mozilla.org/tracemonkey/rev/74416c7004c5 :

changeset:   26137:74416c7004c5
user:        Jim Blandy
date:        Mon Mar 16 09:55:06 2009 -0700
summary:     Bug 480132: Clone lexical blocks only when needed. r=igor

(I just rechecked with non-upvar2 TM tip, the testcase in comment #0 no longer asserts.)

Comment 3

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/tracemonkey/rev/ce1cbb80b939

/cvsroot/mozilla/js/tests/js1_8/regress/regress-483749.js,v  <--  regress-483749.js
initial revision: 1.1

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2] (away 02/17 - 02/21)]

Verified fixed with testcase in comment 0 with the following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090522 Minefield/3.6a1pre ID:20090522133810

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre)
Gecko/20090522 Shiretoko/3.5pre ID:20090522153422