Closed Bug 762450 Opened 7 years ago Closed 7 years ago

Assertion failure: !script()->formalIsAliased(i), at vm/Stack-inl.h:250

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla16

People

(Reporter: decoder, Assigned: luke)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: js-triage-needed)

Attachments

(1 file, 1 obsolete file)

The following test asserts on mozilla-central revision cf4face65451 (options -m -n -a):


function f(a, b, c) {
    arguments.length = (c--) + 1;
}
f();
Attached patch patch and fix (obsolete) — Splinter Review
Nobody expects the js_InternalInterpret!
Assignee: general → luke
Status: NEW → ASSIGNED
Attachment #631124 - Flags: review?(bhackett1024)
Attachment #631124 - Flags: review?(bhackett1024) → review+
Attached patch fix and testSplinter Review
Incredibly, DoIncDec is totally wrong when &v != slot.  (This was only exposed with bug 659577 which added the first such use.)
Attachment #631124 - Attachment is obsolete: true
Attachment #631151 - Flags: review?(bhackett1024)
Comment on attachment 631151 [details] [diff] [review]
fix and test

Patch has unrelated changes in FinishVarIncOp
Attachment #631151 - Flags: review?(bhackett1024) → review+
The changes in FinishVarIncOp is the patch in comment 1; the new patch adds the fix in DoIncDec.
https://hg.mozilla.org/mozilla-central/rev/b1e796090d2c

(Merged by Ed Morley)
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Duplicate of this bug: 762014
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug762450.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.