"Assertion failure: !pn->isOp(JSOP_NOP),"

VERIFIED FIXED in mozilla17

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
6 years ago
5 years ago

People

(Reporter: gkw, Assigned: gkw)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla17
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 .x+)

Details

Attachments

(2 attachments, 2 obsolete attachments)

(Assignee)

Description

6 years ago
Created attachment 512031 [details]
stack

(function() {
  function a() {}
  function a() {}
}
for

asserts js debug shell on TM changeset 8c7a2550e761 without -m nor -j at Assertion failure: pn->pn_op != JSOP_NOP


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   27012:2cf0bbe3772a
parent:      26975:7d681f116714
user:        Brendan Eich
date:        Sun Apr 05 21:17:22 2009 -0700
summary:     upvar2, aka the big one take 2 (452498, r=mrbkap).
(Assignee)

Comment 1

6 years ago
Created attachment 512032 [details]
corrected stack

previous stack was incomplete :(
Attachment #512031 - Attachment is obsolete: true
If it was a regression in *2009*, we're not going to block on it for FF4.
blocking2.0: ? → -
(Assignee)

Comment 3

6 years ago
(In reply to comment #2)
> If it was a regression in *2009*, we're not going to block on it for FF4.

Having .x would be nice.
blocking2.0: - → ?
blocking2.0: ? → .x
(Assignee)

Updated

6 years ago
OS: Linux → All
Hardware: x86 → All
(Assignee)

Updated

6 years ago
Duplicate of this bug: 620670
(Assignee)

Updated

6 years ago
Whiteboard: js-triage-needed
(Assignee)

Comment 5

6 years ago
Still occurs in m-c changeset 5c8405e6226e which has now morphed to:

Assertion failure: !pn->isOp(JSOP_NOP),
Summary: "Assertion failure: pn->pn_op != JSOP_NOP," → "Assertion failure: !pn->isOp(JSOP_NOP),"
I looked into this and this assert seems to be too strict. MakeDefIntoUse checks that this kind of function statments are NOP.
(Assignee)

Comment 7

5 years ago
(In reply to Tom Schuster (evilpie) from comment #6)
> I looked into this and this assert seems to be too strict. MakeDefIntoUse
> checks that this kind of function statments are NOP.

Any hope of a quick patch? ;-)
(Assignee)

Comment 8

5 years ago
Created attachment 644595 [details] [diff] [review]
Remove bogus assert

Luke, asking for review here since this somewhat looks like code you recently touched, please feel free to switch reviewers if not correct.
Attachment #644595 - Flags: review?(luke)
(Assignee)

Comment 9

5 years ago
I based the patch on evilpie's analysis in comment 6.
Whiteboard: js-triage-needed
(Assignee)

Comment 10

5 years ago
Created attachment 644596 [details] [diff] [review]
same as v1, now with a a test
Attachment #644595 - Attachment is obsolete: true
Attachment #644595 - Flags: review?(luke)
Attachment #644596 - Flags: review?(luke)

Comment 11

5 years ago
Comment on attachment 644596 [details] [diff] [review]
same as v1, now with a a test

That's right, function definitions get a NOP.
Attachment #644596 - Flags: review?(luke) → review+
(Assignee)

Updated

5 years ago
Assignee: general → gary
Status: NEW → ASSIGNED
(Assignee)

Comment 12

5 years ago
Fantastic, thanks for the quick review!

http://hg.mozilla.org/integration/mozilla-inbound/rev/e9e2767a4275
Flags: in-testsuite+
Target Milestone: --- → mozilla17
https://hg.mozilla.org/mozilla-central/rev/e9e2767a4275
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Assignee)

Comment 14

5 years ago
-> VERIFIED based on landed test.
Status: RESOLVED → VERIFIED
(Assignee)

Comment 15

5 years ago
Test was nitpicked in preparation for the landing of another test in another bug.

https://hg.mozilla.org/integration/mozilla-inbound/rev/8758f47b0175
https://hg.mozilla.org/mozilla-central/rev/8758f47b0175
You need to log in before you can comment on or make changes to this bug.