Why are we calling fn->pn_cookie.makeFree() on the following line? http://mxr.mozilla.org/mozilla-central/source/js/src/frontend/Parser.cpp#1507 fn is a placeholder definition stored in the list of lexical dependencies for the current tree context, i.e. we have not yet seen a definition for it. Afaict, upvar cookies are only set during binding, i.e. when we encounter a definition. This would imply that fn->pn_cookie.isFree() is guaranteed to be true. Adding an assertion JS_ASSERT(fn->pn_cookie.isFree()) and running jit-tests doesn't cause any breakage. Ok to remove this line?
Created attachment 643008 [details] [diff] [review] Patch to be reviewed
Comment on attachment 643008 [details] [diff] [review] Patch to be reviewed I don't understand upvar cookies and their use enough to be comfortable reviewing this, sorry. One thing, however: you should run jstests.py as well as jit-tests; that will give you a *lot* more test coverage. Use a command something like this: python tests/jstests.py -j 8 $BUILD/js
You need to log in before you can comment on or make changes to this bug.