776191 - "Assertion failure: slotInRange(slot),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function() {
    let(a, b, c, d)((function() {
        with({}) let(b)((function() {
            c.z
        })())
    })())
})()

asserts js debug shell on m-c changeset 01929e390ba5 without any CLI arguments at Assertion failure: slotInRange(slot),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   99533:99aaaee4e6b9
user:        Luke Wagner
date:        Thu Jul 05 20:35:08 2012 -0700
summary:     Bug 753158 - emit ALIASEDVAR ops for upvars (r=bhackett)

Comment 2

[Luke Wagner [:luke]]

Attachment: fix and test

Another pretty old bug where we don't deoptimize hard enough for 'with'.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/4ee96b33d289

Luke, apologies I forgot to update the name of the patch author to you.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Backed out wrong author (Maybe next time I should use r=DONOTBUILD or is that the correct syntax?)

http://hg.mozilla.org/integration/mozilla-inbound/rev/7fbc32b0481e

And relanded with the correct author:

http://hg.mozilla.org/integration/mozilla-inbound/rev/f872ba0b17ca

Comment 5

[Luke Wagner [:luke]]

I'm happy to share credit :)

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/f872ba0b17ca

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug776191.js.