Last Comment Bug 772012 - Assertion failure: !script()->formalIsAliased(i), at vm/Stack-inl.h:253
: Assertion failure: !script()->formalIsAliased(i), at vm/Stack-inl.h:253
Status: RESOLVED FIXED
[js:t][jsbugmon:update]
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: mozilla16
Assigned To: :Benjamin Peterson
:
:
Mentors:
: 768850 (view as bug list)
Depends on:
Blocks: langfuzz
  Show dependency tree / graph
 
Reported: 2012-07-09 03:54 PDT by Christian Holler (:decoder)
Modified: 2012-08-21 06:35 PDT (History)
8 users (show)
ryanvm: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Attachments
don't set the rest parameter if it's actually a function (4.86 KB, patch)
2012-07-09 14:36 PDT, :Benjamin Peterson 		no flags Details | Diff | Splinter Review
don't set the rest parameter if it's actually a function (5.66 KB, patch)
2012-07-09 14:40 PDT, :Benjamin Peterson 		jorendorff: review+
Details | Diff | Splinter Review
don't set the rest parameter if it's actually a function (6.16 KB, patch)
2012-07-11 13:58 PDT, :Benjamin Peterson 		no flags Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Description Christian Holler (:decoder) 2012-07-09 03:54:29 PDT 
The following test asserts on mozilla-central revision 1ee6c61e0a0b (no options required):


function f4(a=42, ...f)  {
  typeof (function() { 
    do { for(a.b in []) { } } while("c\\d"); }
  );
  function f() {}
}
f4();
Comment 1 :Benjamin Peterson 2012-07-09 14:36:07 PDT 
Created attachment 640364 [details] [diff] [review]
don't set the rest parameter if it's actually a function
Comment 2 :Benjamin Peterson 2012-07-09 14:40:53 PDT 
Created attachment 640366 [details] [diff] [review]
don't set the rest parameter if it's actually a function

Forgot to add test...
Comment 3 Ryan VanderMeulen [:RyanVM] 2012-07-10 15:47:41 PDT 
https://hg.mozilla.org/mozilla-central/rev/50ab0f0736c8
Comment 4 :Benjamin Peterson 2012-07-10 15:52:37 PDT 
I put the wrong number in the commit message.
Comment 5 Jesse Ruderman 2012-07-10 15:59:58 PDT 
I guess that commit was for bug 769072.
Comment 6 :Benjamin Peterson 2012-07-10 16:03:40 PDT 
(In reply to Jesse Ruderman from comment #5)
> I guess that commit was for bug 769072.

Indeed.
Comment 7 Jason Orendorff [:jorendorff] 2012-07-11 12:18:38 PDT 
Comment on attachment 640366 [details] [diff] [review]
don't set the rest parameter if it's actually a function

Review of attachment 640366 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/frontend/BytecodeEmitter.cpp
@@ +6011,4 @@
>                  if (Emit1(cx, bce, JSOP_REST) < 0)
>                      return false;
>                  CheckTypeSet(cx, bce, JSOP_REST);
> +                if (restIsDefn) {

A comment here on the significance of restIsDefn would be nice. But maybe I just think that because I am dumb and I got it upside-down when I first read it.

Could use a similar one-liner below, on this if-statement:

        for (ParseNode *pn2 = pn->pn_head; pn2 != pnlast; pn2 = pn2->pn_next) {
            if (!pn2->isDefn())
                continue;
Comment 8 :Benjamin Peterson 2012-07-11 13:58:02 PDT 
Created attachment 641187 [details] [diff] [review]
don't set the rest parameter if it's actually a function
Comment 9 Ryan VanderMeulen [:RyanVM] 2012-07-12 16:38:21 PDT 
https://hg.mozilla.org/integration/mozilla-inbound/rev/03e30c5fde87
Comment 10 Ed Morley [:emorley] 2012-07-13 05:30:45 PDT 
https://hg.mozilla.org/mozilla-central/rev/03e30c5fde87
Comment 11 Jason Orendorff [:jorendorff] 2012-08-21 06:35:36 PDT 
*** Bug 768850 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.