Assertion failure: data.s.payload.why == why, at js/Value.h:1048

RESOLVED FIXED in mozilla22

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla22
x86
Linux
assertion, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on mozilla-central revision 885cde564ff3 (no options required):


function foo() {
  eval("\
    var arguments;\
    for each(e in [arguments, arguments]) {}\
  ");
}
foo();
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect]
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
(Reporter)

Comment 1

5 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122445:e3b899354a6f
user:        Brian Hackett
date:        Wed Feb 20 04:54:13 2013 -0700
summary:     Bug 842522 - Don't force construction of arguments objects in the presence of dynamic name accesses, r=luke.

This iteration took 99.642 seconds to run.
(Reporter)

Comment 2

5 years ago
Needinfo from Brian based on comment 1 :)
Flags: needinfo?(bhackett1024)
(Assignee)

Updated

5 years ago
Duplicate of this bug: 844049
(Assignee)

Updated

5 years ago
Duplicate of this bug: 843985
(Assignee)

Comment 5

5 years ago
Created attachment 717132 [details] [diff] [review]
patch

Fixes for this and bug 843985.

This bug was caused by there not being a lexical dependency for 'arguments' in an eval if the eval redeclared 'arguments', despite that redeclaration using whatever name happened to be in the parent function's scope.  This also affects rest parameters, as 'eval("var arguments")' in a function with a rest parameter would not throw but would give the arguments an undefined value (since no arguments binding is constructed).

Bug 843985 was caused by the refactoring in ScriptAnalysis::needsArgsObj to not properly watch for generator scripts in all cases.
Assignee: general → bhackett1024
Attachment #717132 - Flags: review?(luke)
Flags: needinfo?(bhackett1024)

Updated

5 years ago
Attachment #717132 - Flags: review?(luke) → review+

Comment 7

5 years ago
https://hg.mozilla.org/mozilla-central/rev/8177cabc4e22
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla22
You need to log in before you can comment on or make changes to this bug.