488690 - "Assertion failure: dn->pn_defn, at ../jsemit.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for each (let NaN in [x])
for(let x = (x for ([] in false)) in false);

asserts dbg js shell without -j at Assertion failure: dn->pn_defn, at ../jsemit.cpp:1946

autoBisect shows this is probably related to bug 488015 :

The first bad revision is:
changeset:   27205:78a21b8efe1b
user:        Brendan Eich
date:        Wed Apr 15 01:57:13 2009 -0700
summary:     Bug 488015 - Crash [@ js_GetUpvar ] (also bogus JS errors, also probably Crash [@js_Interpret]) (future r=mrbkap, see bug).

Comment 1

[Mike Beltzner [:beltzner, not reading bugmail]]

Does this block b4 if it's fallout from the upvar fix?

Comment 2

[Brendan Eich [:brendan]]

I'll fix it.

/be

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

eval("(function(){\
  let (x = x.prototype ((\
    x for each (NaN in [])\
    )\
    [function(){}]\
  )) {}\
})()");

asserts debug js shell without -j in a similar way - Assertion failure: pn_defn, at ../jsparse.h:654

I'm guessing this is the same bug, else a new one should be filed.

Comment 4

[Brendan Eich [:brendan]]

Gary: generator expressions in let binding constructs should not be filed as new bugs. We have enough on file! :-/

/be

Comment 5

[Brendan Eich [:brendan]]

Attachment: fix

This logic was just wrong: placeholders starting before the comprehension expr must be split. It also needed consolidation.

/be

Comment 6

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/ed4ac8a1494e

/be

Comment 9

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/ed4ac8a1494e

Comment 10

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/3379c25f6a45

Comment 11

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Verified fixed with given testcases and the following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090522 Minefield/3.6a1pre ID:20090522133810

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre)
Gecko/20090522 Shiretoko/3.5pre ID:20090522153422