Closed Bug 772012 Opened 9 years ago Closed 9 years ago

Assertion failure: !script()->formalIsAliased(i), at vm/Stack-inl.h:253

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla16

People

(Reporter: decoder, Assigned: Benjamin)

References

Details

(Keywords: assertion, testcase, Whiteboard: [js:t][jsbugmon:update])

Attachments

(1 file, 2 obsolete files)

The following test asserts on mozilla-central revision 1ee6c61e0a0b (no options required):


function f4(a=42, ...f)  {
  typeof (function() { 
    do { for(a.b in []) { } } while("c\\d"); }
  );
  function f() {}
}
f4();
Assignee: general → bpeterson
Attachment #640364 - Flags: review?(jorendorff)
Forgot to add test...
Attachment #640364 - Attachment is obsolete: true
Attachment #640364 - Flags: review?(jorendorff)
Attachment #640366 - Flags: review?(jorendorff)
Whiteboard: js-triage-needed [jsbugmon:update] → [js:t][jsbugmon:update]
https://hg.mozilla.org/mozilla-central/rev/50ab0f0736c8
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla16
I put the wrong number in the commit message.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Target Milestone: mozilla16 → ---
Status: REOPENED → NEW
I guess that commit was for bug 769072.
(In reply to Jesse Ruderman from comment #5)
> I guess that commit was for bug 769072.

Indeed.
Comment on attachment 640366 [details] [diff] [review]
don't set the rest parameter if it's actually a function

Review of attachment 640366 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/frontend/BytecodeEmitter.cpp
@@ +6011,4 @@
>                  if (Emit1(cx, bce, JSOP_REST) < 0)
>                      return false;
>                  CheckTypeSet(cx, bce, JSOP_REST);
> +                if (restIsDefn) {

A comment here on the significance of restIsDefn would be nice. But maybe I just think that because I am dumb and I got it upside-down when I first read it.

Could use a similar one-liner below, on this if-statement:

        for (ParseNode *pn2 = pn->pn_head; pn2 != pnlast; pn2 = pn2->pn_next) {
            if (!pn2->isDefn())
                continue;
Attachment #640366 - Flags: review?(jorendorff) → review+
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/03e30c5fde87
Status: NEW → RESOLVED
Closed: 9 years ago9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla16
Duplicate of this bug: 768850
You need to log in before you can comment on or make changes to this bug.