591897 - "Assertion failure: s.slot + 1 == callobj->freeslot,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function({
  x: [w]
},
x) {
  with({}) {}
})()

asserts js debug shell on TM changeset f3e58c264932 at Assertion failure: s.slot + 1 == callobj->freeslot

Probably related to bug 558451.

Comment 1

[Brendan Eich [:brendan]]

Attachment: proposed fix

Comment 2

[Brendan Eich [:brendan]]

Attachment: proposed fix, with test

Jason is out today and tomorrow, Andreas kindly offered to take. But this is more of an Igor patch, since he did the destructuring parameter special-casing in the local names singleton/array/hash.

/be

Comment 3

[Andreas Gal :gal]

Comment on attachment 470558 [details] [diff] [review]
proposed fix, with test

This duplicates the code in the !atom case above and should really go into a helper function.

Comment 4

[Brendan Eich [:brendan]]

Attachment: revised per IRC discussion

Thanks, Igor.

/be

Comment 5

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/47010d096fad

/be

Comment 6

[Brendan Eich [:brendan]]

http://hg.mozilla.org/mozilla-central/rev/47010d096fad

/be

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.