591606 - JM: "Assertion failure: globalScope->defs[defSlot].funbox,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

var c = []
function c(){}

asserts js debug shell on JM changeset e0487d27eb6c without -m nor -j at Assertion failure: globalScope->defs[defSlot].funbox, at ../jsparse.cpp:3446

(Pass in the testcase as a CLI argument)

Program received signal SIGABRT, Aborted.
0xf7fdf430 in __kernel_vsyscall ()
(gdb) bt
#0  0xf7fdf430 in __kernel_vsyscall ()
#1  0xf7fb7610 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:42
#2  0x0818c065 in JS_Assert (s=0x82dae0c "globalScope->defs[defSlot].funbox", file=0x82da6f0 "../jsparse.cpp", ln=3446) at ../jsutil.cpp:83
#3  0x0812864d in DefineGlobal (pn=0x839fb88, cg=0xffffce74, atom=0x833b3a0) at ../jsparse.cpp:3446
#4  0x0812788a in js::Parser::functionDef (this=0xffffcafc, funAtom=0x833b3a0, type=js::Parser::GENERAL, lambda=0) at ../jsparse.cpp:3073
#5  0x081279e9 in js::Parser::functionStmt (this=0xffffcafc) at ../jsparse.cpp:3103
#6  0x0812ba04 in js::Parser::statement (this=0xffffcafc) at ../jsparse.cpp:4721
#7  0x081227ad in js::Compiler::compileScript (cx=0x8399bc8, scopeChain=0xf7502000, callerFrame=0x0, principals=0x0, tcflags=155648, chars=0x0, length=0, file=0x839e440, 
    filename=0xffffd5cd "globalscope.js", lineno=1, source=0x0, staticLevel=0) at ../jsparse.cpp:864
#8  0x08070737 in JS_CompileFileHandleForPrincipals (cx=0x8399bc8, obj=0xf7502000, filename=0xffffd5cd "globalscope.js", file=0x839e440, principals=0x0) at ../jsapi.cpp:4554
#9  0x080707d7 in JS_CompileFileHandle (cx=0x8399bc8, obj=0xf7502000, filename=0xffffd5cd "globalscope.js", file=0x839e440) at ../jsapi.cpp:4566
#10 0x0804c093 in Process (cx=0x8399bc8, obj=0xf7502000, filename=0xffffd5cd "globalscope.js", forceTTY=0) at ../../shell/js.cpp:438
#11 0x0804cfbd in ProcessArgs (cx=0x8399bc8, obj=0xf7502000, argv=0xffffd3f8, argc=1) at ../../shell/js.cpp:862
#12 0x08055bf8 in shell (cx=0x8399bc8, argc=1, argv=0xffffd3f8, envp=0xffffd400) at ../../shell/js.cpp:5150
#13 0x08055d14 in main (argc=1, argv=0xffffd3f8, envp=0xffffd400) at ../../shell/js.cpp:5246

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Bogus assert.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/jaegermonkey/rev/e0e89af9170d

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug591606.js.