Last Comment Bug 740443 - ALIASEDVAR Patch: Assertion failure: function()->isHeavyweight(), at jsscript.cpp:1928
: ALIASEDVAR Patch: Assertion failure: function()->isHeavyweight(), at jsscript...
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
-- critical (vote)
: ---
Assigned To: Luke Wagner [:luke]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz 740259
  Show dependency treegraph
Reported: 2012-03-29 09:56 PDT by Christian Holler (:decoder)
Modified: 2012-04-09 14:35 PDT (History)
2 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image Christian Holler (:decoder) 2012-03-29 09:56:50 PDT
The following test asserts on mozilla-central revision 7ed31daf07bd with patch from bug 740259 (options -m -n):

function foo(x) {}
var q = foo(0  + .5);
function testAddAnyInconvertibleObject( isNaN, Uint16Array ) {
  var count = 0;
  function toString() { 
        return "" + count; 
  function toString (  )  {  }      
q(testAddAnyInconvertibleObject(), "pass");
Comment 1 User image Luke Wagner [:luke] 2012-03-29 16:13:25 PDT
Hah, this one is great!

We parse the first toString, note the upvar, parse the second toString (which has no upvars), then, when it comes time to emit, we only emit the second (since the first is inaccessible).  Since heavyweight-ness gets set in AnalyzeFunctions, we never set heavyweight on the outer function.  Thus, you get an aliased var in a non-heavyweight function, hence the assertion.  The real fix is to kill off AnalyzeFunctions, which I plan to do, but, as a first step, I'll have notClosedVar/Arg flag heavyweight.

Test-case and fix will be in bug 740259.

*** This bug has been marked as a duplicate of bug 740259 ***
Comment 2 User image Gary Kwong [:gkw] [:nth10sd] 2012-04-09 14:35:06 PDT
Fixed by patch in bug 740259 -> FIXED

Note You need to log in before you can comment on or make changes to this bug.