515885 - "Assertion failure: !scope->owned(), at ../jsobj.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (a in (function () {
    return (x for (x in [function(){}]))
})())
    ++b

asserts js debug shell without -j on TM branch at Assertion failure: !scope->owned(), at ../jsobj.cpp:2615

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 511728:

The first bad revision is:
changeset:   32189:297db27579ca
user:        Jason Orendorff
date:        Wed Sep 09 15:53:37 2009 -0500
summary:     Bug 511728 - Misc. cleanup from bug 503080. r=igor.

Comment 2

[Damon Sicore (:damons)]

Since this is only on trunk and doesn't affect 1.9.2, this will not block 1.9.2.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #2)
> Since this is only on trunk and doesn't affect 1.9.2, this will not block
> 1.9.2.

Weird - the fingered bug landed on 1.9.2, so is this really still not blocking?

Comment 4

[Robert Sayre]

that was true when Damon wrote it. why did you nominate it for 1.9.2 when you found it?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #4)
> that was true when Damon wrote it. why did you nominate it for 1.9.2 when you
> found it?

I made a mistake. :( Apologies.

Comment 6

[Robert Sayre]

(In reply to comment #5)
> (In reply to comment #4)
> > that was true when Damon wrote it. why did you nominate it for 1.9.2 when you
> > found it?
> 
> I made a mistake. :( Apologies.

no worries, just making sure.

Comment 7

[Robert Sayre]

jason gets a blocker again.

Comment 8

[Jason Orendorff [:jorendorff]]

Attachment: v1

The top of ComprehensionTail (way outside the context shown in the patch) calls PushLexicalScope regardless of which kind of comprehension we're parsing.

Comment 9

[Brendan Eich [:brendan]]

Comment on attachment 408020 [details] [diff] [review]
v1

Sorry, my bad from the upvar2 patch (right? hard to chase down the offending rev but I think I got it).

/be

Comment 10

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/b388d4491981

Comment 11

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/b388d4491981

Comment 12

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/1b0526ca92e4

Comment 13

[Samuel Sidler (old account; do not CC)]

These bugs landed after b4 was cut. Moving flag out.

Comment 14

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.