Assertion failure: block_->needsClone(), at vm/ScopeObject.cpp:1216

RESOLVED FIXED in mozilla15

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: luke)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
mozilla15
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [js:t])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following test asserts on mozilla-central revision d55df2c9c037 (no options required):


with({}) 
  let([] = 6 ? this : this) {
    eval("enum = true;");
  }


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   94413:f45eec2bd4c7
user:        Luke Wagner
date:        Tue Dec 20 17:42:45 2011 -0800
summary:     Bug 690135 - create scope objects eagerly or not at all (r=jimb)
(Assignee)

Comment 1

5 years ago
Created attachment 625533 [details] [diff] [review]
fix and test

Blah, empty destructuring let.  Might as well preserve the assert.  Simple fix.
Assignee: general → luke
Status: NEW → ASSIGNED
Attachment #625533 - Flags: review?(jwalden+bmo)
Whiteboard: js-triage-needed → [js:t]
jsfunfuzz hits this constantly, too.
Blocks: 349611
Attachment #625533 - Flags: review?(jwalden+bmo) → review+
(Assignee)

Comment 3

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/1c64ae5ff661
Target Milestone: --- → mozilla15
https://hg.mozilla.org/mozilla-central/rev/1c64ae5ff661
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.