Last Comment Bug 743409 - ALIASEDVAR Patch: Assertion failure: data.s.payload.why == why, at jsapi.h:470
: ALIASEDVAR Patch: Assertion failure: data.s.payload.why == why, at jsapi.h:470
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: Luke Wagner [:luke]
:
Mentors:
Depends on:
Blocks: langfuzz 740259
  Show dependency treegraph
 
Reported: 2012-04-06 18:14 PDT by Christian Holler (:decoder)
Modified: 2012-04-09 13:08 PDT (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Christian Holler (:decoder) 2012-04-06 18:14:31 PDT
The following test asserts on mozilla-central revision d0430a04d92a with patch from bug 740259 (options -m -n -a):


function foo(n) {
  foo.apply = function(a, b) { return b[0]; }
  return n;
}
function bar( value ) { return foo.apply(null, arguments); }
for (var i = 0x1 ; i < 20; i++)
  assertEq(bar(i), i);
Comment 1 Luke Wagner [:luke] 2012-04-09 12:52:16 PDT
Thanks!

The JSScript::applySpeculationFailed needs to inject 'unknown' into the pushed set of JSOP_ARGUMENTS, not the 'arguments' local's slot.  Fix and test-case rolled into bug 740259.

*** This bug has been marked as a duplicate of bug 740259 ***

Note You need to log in before you can comment on or make changes to this bug.