Last Comment Bug 766064 - Assertion failure: bce->sc->funIsHeavyweight(), at frontend/BytecodeEmitter.cpp:886
: Assertion failure: bce->sc->funIsHeavyweight(), at frontend/BytecodeEmitter.c...
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
-- critical (vote)
: mozilla16
Assigned To: Luke Wagner [:luke]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz
  Show dependency treegraph
Reported: 2012-06-19 04:43 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 08:47 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

rm assert and add test (1.48 KB, patch)
2012-06-19 09:48 PDT, Luke Wagner [:luke]
jorendorff: review+
Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2012-06-19 04:43:42 PDT
The following test asserts on mozilla-central revision 19bfe36cace8 (options -m -n -a):

function loop( p = 1, actual = this)  {
  for (var i = 0; 
        (function() { 
        actual += this.assertEq + ' toString, '; 
  ++i) { }
Comment 1 User image Luke Wagner [:luke] 2012-06-19 09:48:14 PDT
Created attachment 634475 [details] [diff] [review]
rm assert and add test

Oops, the assert is overly conservative: the heavyweight flag can be set later in rare cases, but the only important thing is that it gets set.

On a side note, the way the heavyweight flag gets set (and closed vars get noted) is pretty awkward.
Comment 3 User image Ryan VanderMeulen [:RyanVM] 2012-06-23 05:44:08 PDT
Comment 4 User image Christian Holler (:decoder) 2013-01-14 08:47:24 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug766064.js.

Note You need to log in before you can comment on or make changes to this bug.