[ObjShrink] "Assertion failure: isScope()," with trap

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 572990 [details]
stack

f = Function("\
    for(let z in [0,,,,,,,0]) {\
        for each (let z in [,,,,,,,,0,,0]) {\
            print(<y/>)\
        }\
    }\
")
trap(f, 155, '')
f()

asserts js debug shell on JM changeset 1210706b4576 with patch v1 from bug 697279 with -d at Assertion failure: isScope(),

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   78136:7b634ad714fd
user:        Brian Hackett
date:        Wed Oct 12 22:29:43 2011 -0700
summary:     Move scope chains of scope objects to reserved slots, bug 694247.
(Assignee)

Comment 1

6 years ago
Created attachment 573238 [details] [diff] [review]
patch

Property cache entries are only filled when all the scope objects are internal (call/block/etc.) or global, and when testing PropertyCache::fullTest assumed an isomorphic chain.  This breaks in debug mode as the debugger can induce construction of new scope objects.

This behavior of lazily creating new scope objects doesn't seem outright wrong but does seem pretty weird.  Will this be going away with bug 659577?
Assignee: general → bhackett1024
Attachment #573238 - Flags: review?(luke)
(Assignee)

Comment 2

6 years ago
https://hg.mozilla.org/projects/jaegermonkey/rev/0c887d263ec6
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED

Comment 3

6 years ago
(In reply to Brian Hackett from comment #1)
> This behavior of lazily creating new scope objects doesn't seem outright
> wrong but does seem pretty weird.  Will this be going away with bug 659577?

They may be created, but they won't be inserted onto the frame's scope chain.  Rather, they will just be on the (new) scope chain for the debugger's eval.

Updated

6 years ago
Attachment #573238 - Flags: review?(luke) → review+
You need to log in before you can comment on or make changes to this bug.