858933 - Assertion failure: !script()->formalIsAliased(i), at ../vm/Stack-inl.h:240

Status: RESOLVED DUPLICATE of bug 855088

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 768af8d8fad4 (no options required):


function f(x) {
    undefined != arguments[0];
    with (arguments = undefined + '') 
      var arguments = false;   
}
f(1);

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122445:e3b899354a6f
user:        Brian Hackett
date:        Wed Feb 20 04:54:13 2013 -0700
summary:     Bug 842522 - Don't force construction of arguments objects in the presence of dynamic name accesses, r=luke.

This iteration took 1.149 seconds to run.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 5bc732a49eae).

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 2aff2d574a1e).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   128509:e329fecc259f
user:        Brian Hackett
date:        Thu Apr 11 16:19:10 2013 -0600
summary:     Bug 855088 - Watch for 'arguments' variables declared within 'with' blocks, r=luke.

This iteration took 133.448 seconds to run.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, is bug 855088 a possible fix?

Comment 5

[Brian Hackett [Laid off!]]

Yes, bug 855088 fixed this.