740443 - ALIASEDVAR Patch: Assertion failure: function()->isHeavyweight(), at jsscript.cpp:1928

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 7ed31daf07bd with patch from bug 740259 (options -m -n):


function foo(x) {}
var q = foo(0  + .5);
function testAddAnyInconvertibleObject( isNaN, Uint16Array ) {
  var count = 0;
  function toString() { 
        return "" + count; 
  }
  function toString (  )  {  }      
}
q(testAddAnyInconvertibleObject(), "pass");

Comment 1

[Luke Wagner [:luke]]

Hah, this one is great!

We parse the first toString, note the upvar, parse the second toString (which has no upvars), then, when it comes time to emit, we only emit the second (since the first is inaccessible).  Since heavyweight-ness gets set in AnalyzeFunctions, we never set heavyweight on the outer function.  Thus, you get an aliased var in a non-heavyweight function, hence the assertion.  The real fix is to kill off AnalyzeFunctions, which I plan to do, but, as a first step, I'll have notClosedVar/Arg flag heavyweight.

Test-case and fix will be in bug 740259.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Fixed by patch in bug 740259 -> FIXED