540242 - TM: "Assertion failure: regs.sp[-1] == OBJECT_TO_JSVAL(fp->scopeChain), at ../jsops.cpp"

Status: RESOLVED DUPLICATE of bug 540528

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (let a = 0; a < 5; a++) {
  b = a
}
(function() {
  var c;
  eval("\
    for (t in [0, 0, 0, 0]) {}\
      with({}) {\
        c = b\
      }\
  ");
})()

asserts js debug shell with -j on TM tip at Assertion failure: regs.sp[-1] == OBJECT_TO_JSVAL(fp->scopeChain), at ../jsops.cpp:185

autoBisect shows this is probably related to bug 495331:

The first bad revision is:
changeset:   37046:910ee7db07de
user:        David Mandelin
date:        Fri Jan 15 11:32:14 2010 -0800
summary:     Bug 495331: trace JSOP_LAMBDA for non-heavyweight, non-null closures, r=jorendorff,dvander

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/closures/bug540242.js.