Last Comment Bug 701248 - Assertion failure: ((js::SrcNoteType)(((*(sn) >> 3) >= SRC_XDELTA) ? SRC_XDELTA : *(sn) >> 3)) == SRC_DESTRUCT, at jsopcode.cpp:3543
: Assertion failure: ((js::SrcNoteType)(((*(sn) >> 3) >= SRC_XDELTA) ? SRC_XDEL...
Status: VERIFIED FIXED
[sg:critical] fixed by 685321 [qa!]
: assertion, testcase, verified-beta
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: Jeff Walden [:Waldo] (remove +bmo to email)
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on: 685321
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2011-11-09 17:10 PST by Christian Holler (:decoder)
Modified: 2013-01-19 13:58 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
-
wontfix
+
fixed
+
fixed
+
verified
unaffected


Attachments

Description Christian Holler (:decoder) 2011-11-09 17:10:12 PST
The following test asserts on mozilla-central revision c60535115ea1 (no options required):


function F(x, y) {
  var { j, y, p, a } = testSyntax("#1=<a>b</a>", true) =  this;
}
var src = F.toSource(-1)+"\n";


Could be related to a decompiler patch that landed recently, Cc'ing Luke and Waldo.
Comment 1 Jeff Walden [:Waldo] (remove +bmo to email) 2011-11-09 23:50:15 PST
Reduced somewhat (potentially morphing, but I don't quite think so), I get this:

  (function F(x) { var {x} = this; }).toSource(-1);

That implicates bug 685321, which I really need to get to soon.  :-\
Comment 2 Daniel Veditz [:dveditz] 2011-11-16 17:11:41 PST
"depends on" rather than "dupe" in case of morphing, but if a patch for that bug fixes this one we can dupe at that time. Please include both Christian's original and your variant as regression tests when you check in.
Comment 3 David Mandelin [:dmandelin] 2011-11-16 19:06:18 PST
Jeff, recording you as assignee since you're working on the likely dup.
Comment 4 David Mandelin [:dmandelin] 2011-11-28 13:53:49 PST

*** This bug has been marked as a duplicate of bug 685321 ***
Comment 5 Daniel Veditz [:dveditz] 2011-12-08 13:56:29 PST
Would like decoder to verify that the fix for bug 685321 really does fix his testcase.
Comment 6 Christian Holler (:decoder) 2011-12-08 15:24:03 PST
Confirmed that the test in comment 0 no longer reproduces on trunk.
Comment 7 Johnny Stenback (:jst, jst@mozilla.com) 2011-12-15 13:21:05 PST
Fixed in 10 by bug 685321.
Comment 8 Mihaela Velimiroviciu (:mihaelav) 2012-02-22 04:14:34 PST
OS: Ubuntu 11.04 64bit
I have built the js from mozilla-beta-52cf2b0c8439 and run the tests from comment #0 and comment #1 and no error was displayed.
Comment 9 Christian Holler (:decoder) 2013-01-19 13:58:19 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.