Last Comment Bug 776191 - "Assertion failure: slotInRange(slot),"
: "Assertion failure: slotInRange(slot),"
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- critical (vote)
: mozilla17
Assigned To: Luke Wagner [:luke]
: general
Mentors:
Depends on:
Blocks: jsfunfuzz 753158
  Show dependency treegraph
 
Reported: 2012-07-20 19:05 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:01 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (2.65 KB, text/plain)
2012-07-20 19:05 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
fix and test (1.54 KB, patch)
2012-07-21 00:24 PDT, Luke Wagner [:luke]
dvander: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-07-20 19:05:28 PDT
Created attachment 644561 [details]
stack

(function() {
    let(a, b, c, d)((function() {
        with({}) let(b)((function() {
            c.z
        })())
    })())
})()

asserts js debug shell on m-c changeset 01929e390ba5 without any CLI arguments at Assertion failure: slotInRange(slot),
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-07-20 19:23:02 PDT
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   99533:99aaaee4e6b9
user:        Luke Wagner
date:        Thu Jul 05 20:35:08 2012 -0700
summary:     Bug 753158 - emit ALIASEDVAR ops for upvars (r=bhackett)
Comment 2 Luke Wagner [:luke] 2012-07-21 00:24:10 PDT
Created attachment 644610 [details] [diff] [review]
fix and test

Another pretty old bug where we don't deoptimize hard enough for 'with'.
Comment 3 Gary Kwong [:gkw] [:nth10sd] 2012-07-23 13:59:14 PDT
http://hg.mozilla.org/integration/mozilla-inbound/rev/4ee96b33d289

Luke, apologies I forgot to update the name of the patch author to you.
Comment 4 Gary Kwong [:gkw] [:nth10sd] 2012-07-23 14:04:43 PDT
Backed out wrong author (Maybe next time I should use r=DONOTBUILD or is that the correct syntax?)

http://hg.mozilla.org/integration/mozilla-inbound/rev/7fbc32b0481e

And relanded with the correct author:

http://hg.mozilla.org/integration/mozilla-inbound/rev/f872ba0b17ca
Comment 5 Luke Wagner [:luke] 2012-07-23 14:11:25 PDT
I'm happy to share credit :)
Comment 6 Ed Morley [:emorley] 2012-07-24 02:59:15 PDT
https://hg.mozilla.org/mozilla-central/rev/f872ba0b17ca
Comment 7 Christian Holler (:decoder) 2013-01-14 08:01:22 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug776191.js.

Note You need to log in before you can comment on or make changes to this bug.