"Assertion failure: slotInRange(slot),"

RESOLVED FIXED in mozilla17

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: gkw, Assigned: luke)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla17
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 644561 [details]
stack

(function() {
    let(a, b, c, d)((function() {
        with({}) let(b)((function() {
            c.z
        })())
    })())
})()

asserts js debug shell on m-c changeset 01929e390ba5 without any CLI arguments at Assertion failure: slotInRange(slot),
(Reporter)

Comment 1

5 years ago
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   99533:99aaaee4e6b9
user:        Luke Wagner
date:        Thu Jul 05 20:35:08 2012 -0700
summary:     Bug 753158 - emit ALIASEDVAR ops for upvars (r=bhackett)
Blocks: 753158
(Assignee)

Comment 2

5 years ago
Created attachment 644610 [details] [diff] [review]
fix and test

Another pretty old bug where we don't deoptimize hard enough for 'with'.
Assignee: general → luke
Status: NEW → ASSIGNED
Attachment #644610 - Flags: review?(dvander)
Attachment #644610 - Flags: review?(dvander) → review+
(Reporter)

Comment 3

5 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/4ee96b33d289

Luke, apologies I forgot to update the name of the patch author to you.
Target Milestone: --- → mozilla17
(Reporter)

Comment 4

5 years ago
Backed out wrong author (Maybe next time I should use r=DONOTBUILD or is that the correct syntax?)

http://hg.mozilla.org/integration/mozilla-inbound/rev/7fbc32b0481e

And relanded with the correct author:

http://hg.mozilla.org/integration/mozilla-inbound/rev/f872ba0b17ca
(Assignee)

Comment 5

5 years ago
I'm happy to share credit :)
https://hg.mozilla.org/mozilla-central/rev/f872ba0b17ca
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug776191.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.