Last Comment Bug 783441 - "Assertion failure: bi->aliased(),"
: "Assertion failure: bi->aliased(),"
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
-- critical (vote)
: mozilla17
Assigned To: Luke Wagner [:luke]
: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz langfuzz 767013
  Show dependency treegraph
Reported: 2012-08-16 18:24 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:19 PST (History)
7 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

stack (8.14 KB, text/plain)
2012-08-16 18:24 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details
fix and test (1.46 KB, patch)
2012-08-17 08:40 PDT, Luke Wagner [:luke]
dvander: review+
Details | Diff | Splinter Review

Description User image Gary Kwong [:gkw] [:nth10sd] 2012-08-16 18:24:52 PDT
Created attachment 652640 [details]

(function(x, x) {
  eval(x = function() {})

asserts js debug shell on m-c changeset a79132ac2f05 without any CLI arguments at Assertion failure: bi->aliased(),

I think bug 775323 may be the cause here.
Comment 1 User image Christian Holler (:decoder) 2012-08-17 01:15:16 PDT
Also hitting this, with varying signatures => fuzzblocker.
Comment 2 User image Gary Kwong [:gkw] [:nth10sd] 2012-08-17 02:38:45 PDT
Actually, bug 767013 may be the cause.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   102515:abc8c217f032
user:        Luke Wagner
date:        Mon Aug 06 07:56:45 2012 -0700
summary:     Bug 767013 - only store aliased variables in scope objects (r=bhackett)
Comment 3 User image Luke Wagner [:luke] 2012-08-17 08:40:46 PDT
Created attachment 652778 [details] [diff] [review]
fix and test

/me shakes fist at duplicate formal args...
simple fix though
Comment 5 User image Ryan VanderMeulen [:RyanVM] 2012-08-18 04:26:14 PDT
Comment 6 User image Christian Holler (:decoder) 2013-01-14 08:19:22 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug783441.js.

Note You need to log in before you can comment on or make changes to this bug.