Assertion failure: !script()->formalIsAliased(i), at vm/Stack-inl.h:253

RESOLVED FIXED in mozilla16

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: Benjamin)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla16
x86_64
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [js:t][jsbugmon:update])

Attachments

(1 attachment, 2 obsolete attachments)

(Reporter)

Description

5 years ago
The following test asserts on mozilla-central revision 1ee6c61e0a0b (no options required):


function f4(a=42, ...f)  {
  typeof (function() { 
    do { for(a.b in []) { } } while("c\\d"); }
  );
  function f() {}
}
f4();
(Assignee)

Comment 1

5 years ago
Created attachment 640364 [details] [diff] [review]
don't set the rest parameter if it's actually a function
Assignee: general → bpeterson
Attachment #640364 - Flags: review?(jorendorff)
(Assignee)

Comment 2

5 years ago
Created attachment 640366 [details] [diff] [review]
don't set the rest parameter if it's actually a function

Forgot to add test...
Attachment #640364 - Attachment is obsolete: true
Attachment #640364 - Flags: review?(jorendorff)
Attachment #640366 - Flags: review?(jorendorff)
Whiteboard: js-triage-needed [jsbugmon:update] → [js:t][jsbugmon:update]
https://hg.mozilla.org/mozilla-central/rev/50ab0f0736c8
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla16
(Assignee)

Comment 4

5 years ago
I put the wrong number in the commit message.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Target Milestone: mozilla16 → ---
(Assignee)

Updated

5 years ago
Status: REOPENED → NEW

Comment 5

5 years ago
I guess that commit was for bug 769072.
(Assignee)

Comment 6

5 years ago
(In reply to Jesse Ruderman from comment #5)
> I guess that commit was for bug 769072.

Indeed.
Comment on attachment 640366 [details] [diff] [review]
don't set the rest parameter if it's actually a function

Review of attachment 640366 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/frontend/BytecodeEmitter.cpp
@@ +6011,4 @@
>                  if (Emit1(cx, bce, JSOP_REST) < 0)
>                      return false;
>                  CheckTypeSet(cx, bce, JSOP_REST);
> +                if (restIsDefn) {

A comment here on the significance of restIsDefn would be nice. But maybe I just think that because I am dumb and I got it upside-down when I first read it.

Could use a similar one-liner below, on this if-statement:

        for (ParseNode *pn2 = pn->pn_head; pn2 != pnlast; pn2 = pn2->pn_next) {
            if (!pn2->isDefn())
                continue;
Attachment #640366 - Flags: review?(jorendorff) → review+
(Assignee)

Comment 8

5 years ago
Created attachment 641187 [details] [diff] [review]
don't set the rest parameter if it's actually a function
Attachment #640366 - Attachment is obsolete: true
(Assignee)

Updated

5 years ago
Keywords: checkin-needed
https://hg.mozilla.org/integration/mozilla-inbound/rev/03e30c5fde87
Flags: in-testsuite+
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/03e30c5fde87
Status: NEW → RESOLVED
Last Resolved: 5 years ago5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla16
Duplicate of this bug: 768850
You need to log in before you can comment on or make changes to this bug.