Closed Bug 515885 Opened 12 years ago Closed 12 years ago

"Assertion failure: !scope->owned(), at ../jsobj.cpp"

Categories

(Core :: JavaScript Engine, defect, P2)

x86
macOS
defect

Tracking

()

VERIFIED FIXED
Tracking Status
status1.9.2 --- beta5-fixed

People

(Reporter: gkw, Assigned: jorendorff)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

for (a in (function () {
    return (x for (x in [function(){}]))
})())
    ++b

asserts js debug shell without -j on TM branch at Assertion failure: !scope->owned(), at ../jsobj.cpp:2615
Flags: blocking1.9.2?
autoBisect shows this is probably related to bug 511728:

The first bad revision is:
changeset:   32189:297db27579ca
user:        Jason Orendorff
date:        Wed Sep 09 15:53:37 2009 -0500
summary:     Bug 511728 - Misc. cleanup from bug 503080. r=igor.
Blocks: 511728
Since this is only on trunk and doesn't affect 1.9.2, this will not block 1.9.2.
Flags: blocking1.9.2? → blocking1.9.2-
(In reply to comment #2)
> Since this is only on trunk and doesn't affect 1.9.2, this will not block
> 1.9.2.

Weird - the fingered bug landed on 1.9.2, so is this really still not blocking?
that was true when Damon wrote it. why did you nominate it for 1.9.2 when you found it?
Flags: blocking1.9.2- → blocking1.9.2+
(In reply to comment #4)
> that was true when Damon wrote it. why did you nominate it for 1.9.2 when you
> found it?

I made a mistake. :( Apologies.
(In reply to comment #5)
> (In reply to comment #4)
> > that was true when Damon wrote it. why did you nominate it for 1.9.2 when you
> > found it?
> 
> I made a mistake. :( Apologies.

no worries, just making sure.
Priority: -- → P2
jason gets a blocker again.
Assignee: general → jorendorff
Attached patch v1Splinter Review
The top of ComprehensionTail (way outside the context shown in the patch) calls PushLexicalScope regardless of which kind of comprehension we're parsing.
Attachment #408020 - Flags: review?(brendan)
Comment on attachment 408020 [details] [diff] [review]
v1

Sorry, my bad from the upvar2 patch (right? hard to chase down the offending rev but I think I got it).

/be
Attachment #408020 - Flags: review?(brendan) → review+
http://hg.mozilla.org/tracemonkey/rev/b388d4491981
Flags: in-testsuite+
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/b388d4491981
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
These bugs landed after b4 was cut. Moving flag out.
A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.