728079 - Assertion failure: pn2->pn_u.binary.iflags & 0x1, at js/src/frontend/Parser.cpp:5504

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 78fde7e54d92 (no options required):


version(170);
function test(code) {
    var before = "function f() { " + code + " }";
    var after = eval("(" + before + ")").toString();
}
test("return [[b, a] for ([a, b] of c.items())];");

Comment 1

[Christian Holler (:decoder)]

The first bad revision is:
changeset:   86351:90ecec15f74b
user:        Jason Orendorff
date:        Tue Feb 07 12:57:16 2012 -0600
summary:     Bug 699565 - Part 1 - for-of loop basics. r=Waldo.

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: v1

Filed follow-up bug 789239.

Comment 3

[Jeff Walden [:Waldo]]

Comment on attachment 659293 [details] [diff] [review]
v1

Review of attachment 659293 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit-test/tests/for-of/bug-728079-js17-1.js
@@ +1,5 @@
> +// for-of does not trigger the JS 1.7 for-in destructuring special case.
> +
> +version(170);
> +
> +var data = [[1, 2, 3], [4, 5, 6]];

Maybe make one of these a different length, just for extra error-detection?

::: js/src/jit-test/tests/for-of/bug-728079-js17-2.js
@@ +2,5 @@
> +
> +version(170);
> +load(libdir + "asserts.js");
> +
> +var data = [[1, 2, 3], [4, 5, 6]];

Same.

::: js/src/jit-test/tests/for-of/bug-728079-js17-3.js
@@ +1,3 @@
> +// Cleaned-up version of bug 728079 comment 0.
> +
> +version(170);

???  (Really clean!)

Comment 5

[Jason Orendorff [:jorendorff]]

(In reply to Jeff Walden [:Waldo] (remove +bmo to email) from comment #3)
> ::: js/src/jit-test/tests/for-of/bug-728079-js17-3.js
> @@ +1,3 @@
> > +// Cleaned-up version of bug 728079 comment 0.
> > +
> > +version(170);
> 
> ???  (Really clean!)

The patch, bizarrely, was missing a newline on the last line. This apparently triggers a bug in Splinter.

The actual test was:

> eval("(function f() { return [[b, a] for ([a, b] of c.items())]; })");

Comment 6

[Jesse Ruderman]

I filed bug 791137 on the Splinter issue.

Comment 7

[Jason Orendorff [:jorendorff]]

Thanks, Jesse. I apologize for not seeing to it myself.

https://hg.mozilla.org/integration/mozilla-inbound/rev/5acfcf041a40

Comment 8

[Graeme McCutcheon [:graememcc]]

https://hg.mozilla.org/mozilla-central/rev/5acfcf041a40

Comment 9

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 0c8ac138706e).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   107370:5acfcf041a40
user:        Jason Orendorff
date:        Thu Sep 13 07:56:52 2012 -0500
summary:     Bug 728079 - "Assertion failure: pn2->pn_u.binary.iflags & 0x1" with JS 1.7, for-of loop, and destructuring. r=Waldo.

Comment 10

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/for-of/bug-728079-js17-3.js.