488475 - "Assertion failure: !(pn->pn_dflags & flag), at ../jsparse.h"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function(){var x; (x = [] for each (functional in [-1/0])})();

asserts dbg TM tip shell without -j at Assertion failure: !(pn->pn_dflags & flag), at ../jsparse.h:660

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 488015.

The first bad revision is:
changeset:   27205:78a21b8efe1b
tag:         tip
user:        Brendan Eich
date:        Wed Apr 15 01:57:13 2009 -0700
summary:     Bug 488015 - Crash [@ js_GetUpvar ] (also bogus JS errors, also probably Crash [@js_Interpret]) (future r=mrbkap, see bug).

Comment 2

[Brendan Eich [:brendan]]

Thanks -- will mop up today.

/be

Comment 3

[Brendan Eich [:brendan]]

Generator expressions, my nemesis.

/be

Comment 4

[Brendan Eich [:brendan]]

Attachment: fix

r=me, this one is a mulligan.

/be

Comment 5

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/65b7d018df1a

/be

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/65b7d018df1a

Comment 7

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/1ce06e13aa97

Comment 8

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Verified fixed with testcase given in comment 0 on trunk and 1.9.1 with the
following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090422 Minefield/3.6a1pre ID:20090422224452

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre)
Gecko/20090422 Shiretoko/3.5b4pre ID:20090422122043