If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Assertion failure: pn2->pn_u.binary.iflags & 0x1, at js/src/frontend/Parser.cpp:5504

RESOLVED FIXED in mozilla18

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Assigned: jorendorff)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla18
x86_64
Linux
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update,ignore])

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following test asserts on mozilla-central revision 78fde7e54d92 (no options required):


version(170);
function test(code) {
    var before = "function f() { " + code + " }";
    var after = eval("(" + before + ")").toString();
}
test("return [[b, a] for ([a, b] of c.items())];");
(Reporter)

Comment 1

6 years ago
The first bad revision is:
changeset:   86351:90ecec15f74b
user:        Jason Orendorff
date:        Tue Feb 07 12:57:16 2012 -0600
summary:     Bug 699565 - Part 1 - for-of loop basics. r=Waldo.
Blocks: 699565
Keywords: regression
(Reporter)

Updated

5 years ago
Whiteboard: js-triage-needed → [jsbugmon:update]
(Assignee)

Updated

5 years ago
Assignee: general → jorendorff
Whiteboard: [jsbugmon:update] → [jsbugmon:update,bisectfix]
(Assignee)

Comment 2

5 years ago
Created attachment 659293 [details] [diff] [review]
v1

Filed follow-up bug 789239.
Attachment #659293 - Flags: review?(jwalden+bmo)
Comment on attachment 659293 [details] [diff] [review]
v1

Review of attachment 659293 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit-test/tests/for-of/bug-728079-js17-1.js
@@ +1,5 @@
> +// for-of does not trigger the JS 1.7 for-in destructuring special case.
> +
> +version(170);
> +
> +var data = [[1, 2, 3], [4, 5, 6]];

Maybe make one of these a different length, just for extra error-detection?

::: js/src/jit-test/tests/for-of/bug-728079-js17-2.js
@@ +2,5 @@
> +
> +version(170);
> +load(libdir + "asserts.js");
> +
> +var data = [[1, 2, 3], [4, 5, 6]];

Same.

::: js/src/jit-test/tests/for-of/bug-728079-js17-3.js
@@ +1,3 @@
> +// Cleaned-up version of bug 728079 comment 0.
> +
> +version(170);

???  (Really clean!)
Attachment #659293 - Flags: review?(jwalden+bmo) → review+
(Assignee)

Updated

5 years ago
Duplicate of this bug: 785989
(Assignee)

Comment 5

5 years ago
(In reply to Jeff Walden [:Waldo] (remove +bmo to email) from comment #3)
> ::: js/src/jit-test/tests/for-of/bug-728079-js17-3.js
> @@ +1,3 @@
> > +// Cleaned-up version of bug 728079 comment 0.
> > +
> > +version(170);
> 
> ???  (Really clean!)

The patch, bizarrely, was missing a newline on the last line. This apparently triggers a bug in Splinter.

The actual test was:

> eval("(function f() { return [[b, a] for ([a, b] of c.items())]; })");

Comment 6

5 years ago
I filed bug 791137 on the Splinter issue.
(Assignee)

Comment 7

5 years ago
Thanks, Jesse. I apologize for not seeing to it myself.

https://hg.mozilla.org/integration/mozilla-inbound/rev/5acfcf041a40
https://hg.mozilla.org/mozilla-central/rev/5acfcf041a40
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisectfix] → [jsbugmon:update,ignore]
(Reporter)

Comment 9

5 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 0c8ac138706e).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   107370:5acfcf041a40
user:        Jason Orendorff
date:        Thu Sep 13 07:56:52 2012 -0500
summary:     Bug 728079 - "Assertion failure: pn2->pn_u.binary.iflags & 0x1" with JS 1.7, for-of loop, and destructuring. r=Waldo.
(Reporter)

Comment 10

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/for-of/bug-728079-js17-3.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.