591604 - JM: Crash [@ js::CheckRedeclaration] or "Assertion failure: parent,"

Status: RESOLVED DUPLICATE of bug 588362

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (a = 0; a < 5; a++) {
    (function n() { {
            function s() {}
        }
        yield[];
    }());
}

crashes js opt shell on JM changeset e0487d27eb6c with -m and -j at js::CheckRedeclaration and asserts js debug shell at Assertion failure: parent, at ../jsinterp.cpp:5557

Program received signal SIGABRT, Aborted.
0xf7fdf430 in __kernel_vsyscall ()
(gdb) bt
#0  0xf7fdf430 in __kernel_vsyscall ()
#1  0xf7fb7610 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:42
#2  0x0818c065 in JS_Assert (s=0x830d7ee "parent", file=0x830e201 "../jsinterp.cpp", ln=5557) at ../jsutil.cpp:83
#3  0x0829d2ce in js::Interpret (cx=0x8399bc8, entryFrame=0xf77ac100, inlineCallCount=0) at ../jsinterp.cpp:5557
#4  0x08266114 in PartialInterpret (f=...) at ../methodjit/InvokeHelpers.cpp:750
#5  0x08266273 in RemoveExcessFrames (f=..., entryFrame=0xf77ac098) at ../methodjit/InvokeHelpers.cpp:791
#6  0x082666a9 in RunTracer (f=..., mic=...) at ../methodjit/InvokeHelpers.cpp:914
#7  0x08266968 in js::mjit::stubs::InvokeTracer (f=..., index=5) at ../methodjit/InvokeHelpers.cpp:973
#8  0xf76a4466 in ?? ()
#9  0x0821bcd4 in EnterMethodJIT (cx=0x8399bc8, fp=0xf77ac098, code=0xf76a405c, safePoint=0x0) at ../methodjit/MethodJIT.cpp:757
#10 0x0821be33 in js::mjit::JaegerShot (cx=0x8399bc8) at ../methodjit/MethodJIT.cpp:783
#11 0x080de86b in js::RunScript (cx=0x8399bc8, script=0x839ee40, fun=0x0, scopeChain=0xf7502000) at ../jsinterp.cpp:465
#12 0x080df7a7 in js::Execute (cx=0x8399bc8, chain=0xf7502000, script=0x839ee40, down=0x0, flags=0, result=0xffffd200) at ../jsinterp.cpp:942
#13 0x08070f56 in JS_ExecuteScript (cx=0x8399bc8, obj=0xf7502000, script=0x839ee40, rval=0xffffd200) at ../jsapi.cpp:4776
#14 0x0804c42b in Process (cx=0x8399bc8, obj=0xf7502000, filename=0x0, forceTTY=0) at ../../shell/js.cpp:535
#15 0x0804cfbd in ProcessArgs (cx=0x8399bc8, obj=0xf7502000, argv=0xffffd408, argc=2) at ../../shell/js.cpp:862
#16 0x08055bf8 in shell (cx=0x8399bc8, argc=2, argv=0xffffd408, envp=0xffffd414) at ../../shell/js.cpp:5150
#17 0x08055d14 in main (argc=2, argv=0xffffd408, envp=0xffffd414) at ../../shell/js.cpp:5246

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 588362).