Assertion failure: !val.isMagic(), at jsobj.cpp:4647

RESOLVED FIXED in mozilla23

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Other Branch
mozilla23
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update,origRev=c9bf19d37fe0,ignore])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase asserts on baseline compiler branch revision 9b49708949da (run with ):


(function (y) {
    arguments.y = 2;
    with (0) var arguments=5;    
})(1);
(Reporter)

Updated

5 years ago
Group: core-security
I can reproduce this on mozilla-inbound, revision 61b8a5101c5b.

Let's see if I can tell JSBugMon to bisect this..
No longer blocks: 842258
Summary: BaselineCompiler: Assertion failure: !val.isMagic(), at jsobj.cpp:4647 → Assertion failure: !val.isMagic(), at jsobj.cpp:4647
Whiteboard: [jsbugmon:update] → [jsbugmon:update,bisect,origRev=c9bf19d37fe0]
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,bisect,origRev=c9bf19d37fe0] → [jsbugmon:update,origRev=c9bf19d37fe0]
(Reporter)

Comment 2

5 years ago
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122738:e3b899354a6f
user:        Brian Hackett
date:        Wed Feb 20 04:54:13 2013 -0700
summary:     Bug 842522 - Don't force construction of arguments objects in the presence of dynamic name accesses, r=luke.

This iteration took 151.910 seconds to run.
(Reporter)

Comment 3

5 years ago
Needinfo from Brian based on comment 2 :)
Flags: needinfo?(bhackett1024)
Duplicate of this bug: 855083
Created attachment 735761 [details] [diff] [review]
patch

Declaring a variable within a 'with' statement causes that variable to disappear into a black hole, showing up in neither the containing function's lexical dependencies nor definitions, despite the fact that it is always defined.  This patch hacks around that.  It would be nice if this logic could go in checkFunctionArguments like the related stuff, but that's difficult to do with no record of the new binding recorded anywhere.
Attachment #735761 - Flags: review?(luke)
Flags: needinfo?(bhackett1024)

Comment 6

5 years ago
Comment on attachment 735761 [details] [diff] [review]
patch

I keep hoping the entire way we deal with 'with' will be rewritten...
Attachment #735761 - Flags: review?(luke) → review+
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,origRev=c9bf19d37fe0] → [jsbugmon:update,origRev=c9bf19d37fe0,ignore]
(Reporter)

Comment 8

5 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision d989eab66df4).
https://hg.mozilla.org/mozilla-central/rev/e329fecc259f
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
Duplicate of this bug: 858933
Depends on: 861841
Depends on: 881444
You need to log in before you can comment on or make changes to this bug.