883623 - Assertion failure: !val.isMagic(), at jsobj.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function() {
    eval("\
        arguments.valueOf();\
        with (function(){}){};\
    ");
})()

asserts js debug shell on m-c changeset 36da3cb92193 without any CLI arguments at Assertion failure: !val.isMagic(), at jsobj.cpp


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ce43d28276e4
user:        Brian Hackett
date:        Fri Jun 14 05:58:28 2013 -0600
summary:     Bug 678037 - Enable lazy JS parsing and fix various bugs, r=waldo,evilpie,nobody.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

If we aborted a syntax parse within the eval and needed to start over at some intermediate point, any free variables before that point were not used to deoptimize the calling scripts.

Comment 2

[Brian Hackett [Laid off!]]

Pushing ahead of review.  I doubt this affects either of the remaining bug 678037 crashers, but it might and the fix is simple.

https://hg.mozilla.org/integration/mozilla-inbound/rev/8a22078d93b2

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/8a22078d93b2