ALIASEDVAR Patch: Assertion failure: function()->isHeavyweight(), at jsscript.cpp:1928

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Assigned: luke)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
The following test asserts on mozilla-central revision 7ed31daf07bd with patch from bug 740259 (options -m -n):


function foo(x) {}
var q = foo(0  + .5);
function testAddAnyInconvertibleObject( isNaN, Uint16Array ) {
  var count = 0;
  function toString() { 
        return "" + count; 
  }
  function toString (  )  {  }      
}
q(testAddAnyInconvertibleObject(), "pass");
(Assignee)

Comment 1

6 years ago
Hah, this one is great!

We parse the first toString, note the upvar, parse the second toString (which has no upvars), then, when it comes time to emit, we only emit the second (since the first is inaccessible).  Since heavyweight-ness gets set in AnalyzeFunctions, we never set heavyweight on the outer function.  Thus, you get an aliased var in a non-heavyweight function, hence the assertion.  The real fix is to kill off AnalyzeFunctions, which I plan to do, but, as a first step, I'll have notClosedVar/Arg flag heavyweight.

Test-case and fix will be in bug 740259.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 740259
Fixed by patch in bug 740259 -> FIXED
Resolution: DUPLICATE → FIXED
You need to log in before you can comment on or make changes to this bug.