Closed Bug 785305 Opened 10 years ago Closed 10 years ago

"Assertion failure: pn->isArity(PN_NAME) || pn->isArity(PN_NULLARY),"

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla18

People

(Reporter: gkw, Assigned: Benjamin)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(2 files)

Attached file stack
Reflect.parse("\
  function l(x = (function() {})) {\
	function x() {}\
  }\
")

asserts js debug shell on m-c changeset 29ca472bf2d2 without any CLI arguments at Assertion failure: pn->isArity(PN_NAME) || pn->isArity(PN_NULLARY),

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   95646:70acf458a32d
user:        Benjamin Peterson
date:        Sat Jun 02 20:16:24 2012 +0200
summary:     Bug 759498: fix defaults when arguments are bound as functions, r=jorendorff
Assignee: general → jorendorff
Whiteboard: [jsbugmon:update]
Attachment #657509 - Flags: review?(jorendorff)
Comment on attachment 657509 [details] [diff] [review]
account for strange parse node structure

Review of attachment 657509 [details] [diff] [review]:
-----------------------------------------------------------------

Can we assert there that arg is either PNK_NAME or PNK_ASSIGN? The assertion would document what the heck arg->pn_left is supposed to mean, which is otherwise unobvious.

If not an assertion, then a comment. r=me with that.
Attachment #657509 - Flags: review?(jorendorff) → review+
Assignee: jorendorff → benjamin
https://hg.mozilla.org/mozilla-central/rev/fefdc97754e1
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.