561011 - "Assertion failure: JSVAL_IS_VOID(lval)" involving sharps and "with"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

var a = #1=[#1#]; with ({}) { var b; }

Assertion failure: JSVAL_IS_VOID(lval), at ../jsops.cpp:3476

Testing using TM branch rev 5b05b75cd402.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 514981:

The first bad revision is:
changeset:   32201:c19b0d06d076
user:        Brendan Eich
date:        Wed Sep 09 20:21:15 2009 -0700
summary:     Bug 514981 - JSStackFrame::sharp{Array,Depth} should be locals allocated due to #n[#=] usage (r=igor).

Comment 2

[Brendan Eich [:brendan]]

Attachment: proposed fix

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #2)
> Created an attachment (id=440707) [details]
> proposed fix

This was checked in to TM, thanks Brendan!

http://hg.mozilla.org/tracemonkey/rev/1af19eedbde2

Comment 4

[Jeff Walden [:Waldo]]

This is causing the following test to fail:

var o = { p: 1 };
with (o) { var p = 2; }
assertEq(o.p, 2);

Three failures total, but the second's fallout from the first, and the third is likely duplicative of the first, as far as the eventual fix is likely concerned.

REFTEST TEST-UNEXPECTED-FAIL | file:///builds/slave/tracemonkey-macosx-debug-unittest-jsreftest/build/jsreftest/tests/jsreftest.html?test=js1_5/Scope/regress-185485.js | Section 2 of test - Expected value '2', Actual value '1' item 2
REFTEST TEST-UNEXPECTED-FAIL | file:///builds/slave/tracemonkey-macosx-debug-unittest-jsreftest/build/jsreftest/tests/jsreftest.html?test=js1_5/Scope/regress-185485.js | Section 3 of test - Expected value '2', Actual value '1' item 3
REFTEST TEST-UNEXPECTED-FAIL | file:///builds/slave/tracemonkey-macosx-debug-unittest-jsreftest/build/jsreftest/tests/jsreftest.html?test=js1_5/Scope/regress-185485.js | Section 5 of test - Expected value 'function () {NL}', Actual value '0' item 5

Comment 5

[Robert Sayre]

backed out:

http://hg.mozilla.org/tracemonkey/rev/f1bc91ce880e

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/1af19eedbde2

Comment 7

[Brendan Eich [:brendan]]

This was backed out of tm.

/be

Comment 8

[Robert Sayre]

oops, sorry.

Comment 10

[Brendan Eich [:brendan]]

Attachment: fix, take two

Comment 11

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/5ef421117c44

/be

Comment 12

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/5ef421117c44