The default bug view has changed. See this FAQ.

Crash [@ js::frontend::EmitTree]

RESOLVED FIXED in mozilla11

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: Waldo)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
mozilla11
crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-done, crash signature)

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 573357 [details]
stack

d, {
  x: [{
    x: x::x
  }]
} = q

crashes js debug and opt shell on m-c changeset 4fb61ebbf8ff with patch v1 from bug 697279 without any CLI arguments at js::frontend::EmitTree

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   80013:944c81533751
user:        Jeff Walden
date:        Tue Oct 25 16:04:48 2011 -0700
summary:     Bug 697297 - Replace TOK_UNARYOP with separate kinds for each op it covers, in both the tokenizer and in the parser (with different semantics in each!).  r=dherman, r=cdleary
(Reporter)

Updated

5 years ago
Crash Signature: [@ js::frontend::EmitTree]
Created attachment 573406 [details] [diff] [review]
Patch with tests

The problem is I took one sort of punning -- on TOK_UNARYOP -- and incompletely replaced it with another sort -- on TOK_{AT,ANYNAME,DBLCOLON}.  Probably completely replacing would have avoided this problem, but that wouldn't avoid the punning confusion.  I really should have used a new kind for these rather than just bifurcating the punning -- it's definitely much clearer.

This patch adds a new kind with the sense that TOK_UNARYOP had.  It passes all tests, plus the one here and the one in bug 701224 (and the one from bug 701227, which is functionally identical to bug 701224).  And I'm definitely happier with it than with the corresponding aspects of the patch that caused this regression.
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
Attachment #573406 - Flags: review?(cdleary)
Attachment #573406 - Flags: review?(cdleary) → review+
Er, when I said "and the one from bug 701227, which is functionally identical to bug 701224", I really meant "and the one from bug 701247, which is functionally identical to bug 701224".

https://hg.mozilla.org/integration/mozilla-inbound/rev/46b40e2c1953
OS: Mac OS X → All
Hardware: x86 → All
Whiteboard: js-triage-needed → js-triage-done
Target Milestone: --- → mozilla11
https://hg.mozilla.org/mozilla-central/rev/46b40e2c1953
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.