780494 - Assertion failure: script->formalLivesInCallObject(i)

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

1. http://sink.derbyjs.com/submit
2. Assertion failure: script->formalLivesInCallObject(i), at ../../../js/src/vm/ScopeObject.cpp:228

Firefox/14, Beta/15 all platforms. Aurora/16 and Nightly/17 are fixed. It is not clear to me from the pushlogs who regressed this or who fixed it. I can bisect further if you care.

Found regression between 20120410224831-20120411235033
Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e636439e342f&tochange=8eb367e5b053
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/04/2012-04-11-mozilla-central-debug/firefox-14.0a1.en-US.debug-linux-i686.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/04/2012-04-12-mozilla-central-debug/firefox-14.0a1.en-US.debug-linux-i686.tar.bz2

Found fix between 20120604204045-20120606012421
Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a7a905fd70d5&tochange=a6c39a15557b
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/06/2012-06-05-mozilla-central-debug/firefox-16.0a1.en-US.debug-linux-i686.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/06/2012-06-06-mozilla-central-debug/firefox-16.0a1.en-US.debug-linux-i686.tar.bz2

Comment 1

[Luke Wagner [:luke]]

So the cause is bug 740259 and the fix should be one of the patches in bug 659577.  What happened is that the former added code that asserted the invariant required by the latter.  However, this invariant wasn't required by the former (it didn't change dynamic semantics) so, as long as the bug has been fixed by the latter I think we don't need to fix anything on FF14/15.  Tentatively resolving WONTFIX based on this assumption.