487570 - "Assertion failure: fn->isFunArg(), at ../jsparse.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function(){
  for each (var x in new (
    (function (){x})() 
    for each (y in [])
  )
) 
{const functional}
})()

asserts dbg TM tip without -j at Assertion failure: fn->isFunArg(), at ../jsparse.cpp:1716

autoBisect shows this is probably related to bug 487538 or http://hg.mozilla.org/tracemonkey/rev/671b816a0aa9

The first bad revision is:
changeset:   27047:671b816a0aa9
user:        Brendan Eich
date:        Wed Apr 08 18:27:44 2009 -0700
summary:     Bug 487538 - bug 487271 left three tests broken in its wake (r=mrbkap).

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

This will be fixed by the patch in bug 487561. In particular, the JSParseNode::setFunArg is incorrect for definitions that are also used (I think).

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This assert is 100% reproducable for me by loading http://crash-stats.mozilla.com/ ; the crash is while parsing http://crash-stats.mozilla.com/js/jquery/plugins/ui/jquery.ui.all.js

Comment 3

[Brendan Eich [:brendan]]

Fixed in tm by patch for bug 487561. Could dup, leaving dependent for now.

/be

Comment 4

[Robert Sayre]

fixed1.9.1 by  Bug 487561

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Verified fixed with testcase in comment 0 with the following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090522 Minefield/3.6a1pre ID:20090522133810

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre)
Gecko/20090522 Shiretoko/3.5pre ID:20090522153422

Comment 6

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929