"Assertion failure: dn->pn_defn, at ../jsemit.cpp"

VERIFIED FIXED in mozilla1.9.2a1

Status

()

Core
JavaScript Engine
P1
critical
VERIFIED FIXED
9 years ago
8 years ago

People

(Reporter: gkw, Assigned: brendan)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla1.9.2a1
assertion, regression, testcase, verified1.9.1
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9.1 +
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
for each (let NaN in [x])
for(let x = (x for ([] in false)) in false);

asserts dbg js shell without -j at Assertion failure: dn->pn_defn, at ../jsemit.cpp:1946

autoBisect shows this is probably related to bug 488015 :

The first bad revision is:
changeset:   27205:78a21b8efe1b
user:        Brendan Eich
date:        Wed Apr 15 01:57:13 2009 -0700
summary:     Bug 488015 - Crash [@ js_GetUpvar ] (also bogus JS errors, also probably Crash [@js_Interpret]) (future r=mrbkap, see bug).
Flags: blocking1.9.1?
Does this block b4 if it's fallout from the upvar fix?
(Assignee)

Comment 2

9 years ago
I'll fix it.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: x86 → All
Target Milestone: --- → mozilla1.9.1b4
Flags: blocking1.9.1? → blocking1.9.1+
(Assignee)

Updated

9 years ago
Blocks: 488848
(Reporter)

Comment 3

9 years ago
eval("(function(){\
  let (x = x.prototype ((\
    x for each (NaN in [])\
    )\
    [function(){}]\
  )) {}\
})()");

asserts debug js shell without -j in a similar way - Assertion failure: pn_defn, at ../jsparse.h:654

I'm guessing this is the same bug, else a new one should be filed.
(Assignee)

Comment 4

9 years ago
Gary: generator expressions in let binding constructs should not be filed as new bugs. We have enough on file! :-/

/be
(Assignee)

Comment 5

9 years ago
Created attachment 373747 [details] [diff] [review]
fix

This logic was just wrong: placeholders starting before the comprehension expr must be split. It also needed consolidation.

/be
Attachment #373747 - Flags: review?(mrbkap)

Updated

9 years ago
Attachment #373747 - Flags: review?(mrbkap) → review+
(Assignee)

Comment 6

9 years ago
http://hg.mozilla.org/tracemonkey/rev/ed4ac8a1494e

/be
Whiteboard: fixed-in-tracemonkey
(Assignee)

Updated

9 years ago
Duplicate of this bug: 489130
(Assignee)

Updated

9 years ago
Duplicate of this bug: 488848
(Assignee)

Updated

9 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
(Reporter)

Updated

9 years ago
Flags: in-testsuite?
Verified fixed with given testcases and the following debug builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090522 Minefield/3.6a1pre ID:20090522133810

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre)
Gecko/20090522 Shiretoko/3.5pre ID:20090522153422
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
Target Milestone: mozilla1.9.1b4 → mozilla1.9.2a1
(Reporter)

Updated

8 years ago
Depends on: 533862
You need to log in before you can comment on or make changes to this bug.