The default bug view has changed. See this FAQ.

Assertion failure: !script()->formalIsAliased(i), at vm/Stack-inl.h:250

RESOLVED FIXED in mozilla16

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: decoder, Assigned: luke)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla16
x86
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: js-triage-needed)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

5 years ago
The following test asserts on mozilla-central revision cf4face65451 (options -m -n -a):


function f(a, b, c) {
    arguments.length = (c--) + 1;
}
f();
(Assignee)

Comment 1

5 years ago
Created attachment 631124 [details] [diff] [review]
patch and fix

Nobody expects the js_InternalInterpret!
Assignee: general → luke
Status: NEW → ASSIGNED
Attachment #631124 - Flags: review?(bhackett1024)
Attachment #631124 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 2

5 years ago
Created attachment 631151 [details] [diff] [review]
fix and test

Incredibly, DoIncDec is totally wrong when &v != slot.  (This was only exposed with bug 659577 which added the first such use.)
Attachment #631124 - Attachment is obsolete: true
Attachment #631151 - Flags: review?(bhackett1024)
Comment on attachment 631151 [details] [diff] [review]
fix and test

Patch has unrelated changes in FinishVarIncOp
Attachment #631151 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 4

5 years ago
The changes in FinishVarIncOp is the patch in comment 1; the new patch adds the fix in DoIncDec.
(Assignee)

Comment 5

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/b1e796090d2c
Target Milestone: --- → mozilla16
https://hg.mozilla.org/mozilla-central/rev/b1e796090d2c

(Merged by Ed Morley)
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Assignee)

Updated

5 years ago
Duplicate of this bug: 762014
(Reporter)

Comment 8

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug762450.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.