"Assertion failure: s.slot + 1 == callobj->freeslot,"

VERIFIED FIXED in mozilla2.0b5

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
7 years ago
4 years ago

People

(Reporter: gkw, Assigned: brendan)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla2.0b5
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 beta7+)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment, 2 obsolete attachments)

(Reporter)

Description

7 years ago
(function({
  x: [w]
},
x) {
  with({}) {}
})()

asserts js debug shell on TM changeset f3e58c264932 at Assertion failure: s.slot + 1 == callobj->freeslot

Probably related to bug 558451.
(Reporter)

Updated

7 years ago
blocking2.0: --- → ?
(Assignee)

Comment 1

7 years ago
Created attachment 470547 [details] [diff] [review]
proposed fix
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #470547 - Flags: review?(jorendorff)
(Assignee)

Updated

7 years ago
OS: Mac OS X → All
Hardware: x86 → All
Target Milestone: --- → mozilla2.0b5
(Assignee)

Comment 2

7 years ago
Created attachment 470558 [details] [diff] [review]
proposed fix, with test

Jason is out today and tomorrow, Andreas kindly offered to take. But this is more of an Igor patch, since he did the destructuring parameter special-casing in the local names singleton/array/hash.

/be
Attachment #470547 - Attachment is obsolete: true
Attachment #470558 - Flags: review?(igor)
Attachment #470547 - Flags: review?(jorendorff)

Comment 3

7 years ago
Comment on attachment 470558 [details] [diff] [review]
proposed fix, with test

This duplicates the code in the !atom case above and should really go into a helper function.
Attachment #470558 - Flags: review?(igor)
Attachment #470558 - Flags: review+
Attachment #470558 - Flags: feedback?(igor)
(Assignee)

Comment 4

7 years ago
Created attachment 470566 [details] [diff] [review]
revised per IRC discussion

Thanks, Igor.

/be
Attachment #470558 - Attachment is obsolete: true
Attachment #470566 - Flags: review+
Attachment #470558 - Flags: feedback?(igor)
(Assignee)

Comment 5

7 years ago
http://hg.mozilla.org/tracemonkey/rev/47010d096fad

/be
Whiteboard: fixed-in-tracemonkey

Updated

7 years ago
blocking2.0: ? → beta6+
(Assignee)

Comment 6

7 years ago
http://hg.mozilla.org/mozilla-central/rev/47010d096fad

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Flags: in-testsuite+
(Reporter)

Comment 7

4 years ago
Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.