855088 - Assertion failure: !val.isMagic(), at jsobj.cpp:4647

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on baseline compiler branch revision 9b49708949da (run with ):


(function (y) {
    arguments.y = 2;
    with (0) var arguments=5;    
})(1);

Comment 1

[Jan de Mooij [:jandem]]

I can reproduce this on mozilla-inbound, revision 61b8a5101c5b.

Let's see if I can tell JSBugMon to bisect this..

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122738:e3b899354a6f
user:        Brian Hackett
date:        Wed Feb 20 04:54:13 2013 -0700
summary:     Bug 842522 - Don't force construction of arguments objects in the presence of dynamic name accesses, r=luke.

This iteration took 151.910 seconds to run.

Comment 3

[Christian Holler (:decoder)]

Needinfo from Brian based on comment 2 :)

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

Declaring a variable within a 'with' statement causes that variable to disappear into a black hole, showing up in neither the containing function's lexical dependencies nor definitions, despite the fact that it is always defined.  This patch hacks around that.  It would be nice if this logic could go in checkFunctionArguments like the related stuff, but that's difficult to do with no record of the new binding recorded anywhere.

Comment 6

[Luke Wagner [:luke]]

Comment on attachment 735761 [details] [diff] [review]
patch

I keep hoping the entire way we deal with 'with' will be rewritten...

Comment 7

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e329fecc259f

Comment 8

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision d989eab66df4).

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e329fecc259f