Last Comment Bug 633828 - "Assertion failure: !pn->isOp(JSOP_NOP),"
: "Assertion failure: !pn->isOp(JSOP_NOP),"
Status: VERIFIED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla17
Assigned To: Gary Kwong [:gkw] [:nth10sd]
:
Mentors:
: 620670 (view as bug list)
Depends on:
Blocks: jsfunfuzz upvar2
  Show dependency treegraph
 
Reported: 2011-02-13 08:09 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-09-07 08:45 PDT (History)
13 users (show)
gary: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
.x+


Attachments
stack (3.42 KB, text/plain)
2011-02-13 08:09 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
corrected stack (5.70 KB, text/plain)
2011-02-13 08:11 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
Remove bogus assert (1.01 KB, patch)
2012-07-20 22:31 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details | Diff | Review
same as v1, now with a a test (1.30 KB, patch)
2012-07-20 22:54 PDT, Gary Kwong [:gkw] [:nth10sd]
luke: review+
Details | Diff | Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-02-13 08:09:43 PST
Created attachment 512031 [details]
stack

(function() {
  function a() {}
  function a() {}
}
for

asserts js debug shell on TM changeset 8c7a2550e761 without -m nor -j at Assertion failure: pn->pn_op != JSOP_NOP


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   27012:2cf0bbe3772a
parent:      26975:7d681f116714
user:        Brendan Eich
date:        Sun Apr 05 21:17:22 2009 -0700
summary:     upvar2, aka the big one take 2 (452498, r=mrbkap).
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2011-02-13 08:11:38 PST
Created attachment 512032 [details]
corrected stack

previous stack was incomplete :(
Comment 2 Mike Shaver (:shaver -- probably not reading bugmail closely) 2011-02-14 09:48:58 PST
If it was a regression in *2009*, we're not going to block on it for FF4.
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2011-02-14 14:37:38 PST
(In reply to comment #2)
> If it was a regression in *2009*, we're not going to block on it for FF4.

Having .x would be nice.
Comment 4 Gary Kwong [:gkw] [:nth10sd] 2011-02-24 18:37:15 PST
*** Bug 620670 has been marked as a duplicate of this bug. ***
Comment 5 Gary Kwong [:gkw] [:nth10sd] 2011-12-08 11:58:35 PST
Still occurs in m-c changeset 5c8405e6226e which has now morphed to:

Assertion failure: !pn->isOp(JSOP_NOP),
Comment 6 Tom Schuster [:evilpie] 2012-01-24 11:36:30 PST
I looked into this and this assert seems to be too strict. MakeDefIntoUse checks that this kind of function statments are NOP.
Comment 7 Gary Kwong [:gkw] [:nth10sd] 2012-02-21 17:44:55 PST
(In reply to Tom Schuster (evilpie) from comment #6)
> I looked into this and this assert seems to be too strict. MakeDefIntoUse
> checks that this kind of function statments are NOP.

Any hope of a quick patch? ;-)
Comment 8 Gary Kwong [:gkw] [:nth10sd] 2012-07-20 22:31:53 PDT
Created attachment 644595 [details] [diff] [review]
Remove bogus assert

Luke, asking for review here since this somewhat looks like code you recently touched, please feel free to switch reviewers if not correct.
Comment 9 Gary Kwong [:gkw] [:nth10sd] 2012-07-20 22:32:50 PDT
I based the patch on evilpie's analysis in comment 6.
Comment 10 Gary Kwong [:gkw] [:nth10sd] 2012-07-20 22:54:34 PDT
Created attachment 644596 [details] [diff] [review]
same as v1, now with a a test
Comment 11 Luke Wagner [:luke] 2012-07-20 23:35:06 PDT
Comment on attachment 644596 [details] [diff] [review]
same as v1, now with a a test

That's right, function definitions get a NOP.
Comment 12 Gary Kwong [:gkw] [:nth10sd] 2012-07-20 23:41:07 PDT
Fantastic, thanks for the quick review!

http://hg.mozilla.org/integration/mozilla-inbound/rev/e9e2767a4275
Comment 13 Ryan VanderMeulen [:RyanVM] 2012-07-21 06:20:39 PDT
https://hg.mozilla.org/mozilla-central/rev/e9e2767a4275
Comment 14 Gary Kwong [:gkw] [:nth10sd] 2012-07-21 09:29:03 PDT
-> VERIFIED based on landed test.
Comment 15 Gary Kwong [:gkw] [:nth10sd] 2012-09-07 02:20:20 PDT
Test was nitpicked in preparation for the landing of another test in another bug.

https://hg.mozilla.org/integration/mozilla-inbound/rev/8758f47b0175
Comment 16 Ed Morley [:emorley] 2012-09-07 08:45:23 PDT
https://hg.mozilla.org/mozilla-central/rev/8758f47b0175

Note You need to log in before you can comment on or make changes to this bug.