772012 - Assertion failure: !script()->formalIsAliased(i), at vm/Stack-inl.h:253

Status: RESOLVED FIXED

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 1ee6c61e0a0b (no options required):


function f4(a=42, ...f)  {
  typeof (function() { 
    do { for(a.b in []) { } } while("c\\d"); }
  );
  function f() {}
}
f4();

Comment 1

[:Benjamin Peterson]

Created attachment 640364 [details] [diff] [review]
don't set the rest parameter if it's actually a function

Comment 2

[:Benjamin Peterson]

Created attachment 640366 [details] [diff] [review]
don't set the rest parameter if it's actually a function

Forgot to add test...

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/50ab0f0736c8

Comment 4

[:Benjamin Peterson]

I put the wrong number in the commit message.

Comment 5

[Jesse Ruderman]

I guess that commit was for bug 769072.

Comment 6

[:Benjamin Peterson]

(In reply to Jesse Ruderman from comment #5)
> I guess that commit was for bug 769072.

Indeed.

Comment 7

[Jason Orendorff [:jorendorff]]

Comment on attachment 640366 [details] [diff] [review]
don't set the rest parameter if it's actually a function

Review of attachment 640366 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/frontend/BytecodeEmitter.cpp
@@ +6011,4 @@
>                  if (Emit1(cx, bce, JSOP_REST) < 0)
>                      return false;
>                  CheckTypeSet(cx, bce, JSOP_REST);
> +                if (restIsDefn) {

A comment here on the significance of restIsDefn would be nice. But maybe I just think that because I am dumb and I got it upside-down when I first read it.

Could use a similar one-liner below, on this if-statement:

        for (ParseNode *pn2 = pn->pn_head; pn2 != pnlast; pn2 = pn2->pn_next) {
            if (!pn2->isDefn())
                continue;

Comment 8

[:Benjamin Peterson]

Created attachment 641187 [details] [diff] [review]
don't set the rest parameter if it's actually a function

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/03e30c5fde87

Comment 10

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/03e30c5fde87