Last Comment Bug 767660 - "Assertion failure: pnu->isUsed(),"
: "Assertion failure: pnu->isUsed(),"
Status: VERIFIED FIXED
[js:t]
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Windows 7
: -- critical (vote)
: mozilla16
Assigned To: :Benjamin Peterson
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz 759498
  Show dependency tree / graph
 
Reported: 2012-06-22 22:31 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2012-12-13 17:05 PST (History)
5 users (show)
gary: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Attachments
testcase (90 bytes, text/plain)
2012-06-22 22:31 PDT, Gary Kwong [:gkw] [:nth10sd] 		no flags Details
fix and assurance that it won't happen again (4.40 KB, patch)
2012-06-23 19:59 PDT, :Benjamin Peterson 		jorendorff: review+
Details | Diff | Splinter Review
a few cosmetic changes (4.48 KB, patch)
2012-06-25 13:17 PDT, :Benjamin Peterson 		gary: review+
Details | Diff | Splinter Review
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Description Gary Kwong [:gkw] [:nth10sd] 2012-06-22 22:31:52 PDT 
Created attachment 636029 [details]
testcase

The attached testcase asserts js debug shell on m-i changeset cb74a377095a without any CLI flag arguments at Assertion failure: pnu->isUsed(), when the testcase passed in as a CLI argument.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   97130:70acf458a32d
user:        Benjamin Peterson
date:        Sat Jun 02 20:16:24 2012 +0200
summary:     Bug 759498: fix defaults when arguments are bound as functions, r=jorendorff
Comment 1 :Benjamin Peterson 2012-06-23 19:59:33 PDT 
Created attachment 636128 [details] [diff] [review]
fix and assurance that it won't happen again

That was quite a subtle bug! I have no idea why the defaults provoked it; it seems to be a very old bug.
Comment 2 Jason Orendorff [:jorendorff] 2012-06-25 12:54:37 PDT 
Comment on attachment 636128 [details] [diff] [review]
fix and assurance that it won't happen again

Agreed. That's really strange.
Comment 3 :Benjamin Peterson 2012-06-25 13:17:35 PDT 
Created attachment 636468 [details] [diff] [review]
a few cosmetic changes
Comment 4 Gary Kwong [:gkw] [:nth10sd] 2012-06-25 13:30:49 PDT 
Comment on attachment 636468 [details] [diff] [review]
a few cosmetic changes

Bringing over r+ to avoid potential confusion that this may be a lingering patch in the future.

Landing soon.
Comment 5 Gary Kwong [:gkw] [:nth10sd] 2012-06-25 13:34:11 PDT 
http://hg.mozilla.org/integration/mozilla-inbound/rev/2ae1e57c5851
Comment 6 Ed Morley [:emorley] 2012-06-26 01:58:11 PDT 
https://hg.mozilla.org/mozilla-central/rev/2ae1e57c5851
Comment 7 Gary Kwong [:gkw] [:nth10sd] 2012-12-13 17:05:40 PST 
A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.
Note You need to log in before you can comment on or make changes to this bug.