584423 - "Assertion failure: *pc == JSOP_GETARG,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

uneval(Function("function r([],x){this.b=function(){x}}"))

asserts js debug shell on TM tip without -j at Assertion failure: *pc == JSOP_GETARG, at ../jsopcode.cpp:4990

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   37037:36bbd730e24f
user:        Brendan Eich
date:        Thu Jan 14 09:33:14 2010 -0800
summary:     Analyze module pattern and private-statics pattern in order to despecialize from methods to slots/sprops (536564, r=jorendorff).

Comment 1

[Nicholas Nethercote [inactive]]

The value of *pc is JSOP_UNBRANDTHIS instead of the expected JSOP_GETARG.

Comment 2

[Robert Sayre]

still asserts

Comment 3

[Luke Wagner [:luke]]

Attachment: fix

Explanation in comment.

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 498151 [details] [diff] [review]
fix

>+     * The decompiler has assumptions about what may occur immediately after
>+     * script->main (e.g., in the case of destructured args). Thus, put the
>+     * following ops into the range [script->code, script->main). Note:
>+     * execution starts from script->code, so this has no semantic effect.
..12345678901234567890123456789012345678901234567890123456789012345678901234567890

Nit: "destructuring params" is better and won't rewrap, so use that. Thanks,

/be

Comment 5

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/6d23e573cd87

Comment 6

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/6d23e573cd87

Comment 7

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929