Assertion failure: hasScript(), at jsfun.h

RESOLVED FIXED in mozilla24

Status

()

defect
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks 2 bugs, {assertion, regression, testcase})

Trunk
mozilla24
x86_64
macOS
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

Posted file stack
a = b = c = d = []
e = f = g = h = i = j = k = a[6] = {}
function x() {}
v = []
for (var p in this) {
    Array.prototype.some.call(a, (function() {
        y = Uint8ClampedArray.z
    }))
}

asserts js debug shell on m-c changeset 36da3cb92193 without any CLI arguments at Assertion failure: hasScript(), at jsfun.h

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ce43d28276e4
user:        Brian Hackett
date:        Fri Jun 14 05:58:28 2013 -0600
summary:     Bug 678037 - Enable lazy JS parsing and fix various bugs, r=waldo,evilpie,nobody.
Flags: needinfo?(bhackett1024)
Posted patch patchSplinter Review
When iterating over inlined Ion frames, the callee function may be lazily interpreted.  The script will exist, and the function just needs to be repointed to it.  This patch also cleans up some metastasis in the methods for getting scripts off functions, and adds a comment on how to use the remaining methods.
Assignee: general → bhackett1024
Attachment #763237 - Flags: review?(luke)
Flags: needinfo?(bhackett1024)
Blocks: 883560
https://hg.mozilla.org/mozilla-central/rev/91f620586eb8
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
Comment on attachment 763237 [details] [diff] [review]
patch

Review of attachment 763237 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsfun.h
@@ +242,5 @@
>          JS_ASSERT(hasScript());
>          return u.i.s.script_;
>      }
>  
> +    inline JSScript *getExistingScript();

The usual naming convention is that "getX" means that the operation is fallible.  This one isn't, so could you name it "existingScript()"?
Attachment #763237 - Flags: review?(luke) → review+
Depends on: 883973
(In reply to Luke Wagner [:luke] from comment #4)
> The usual naming convention is that "getX" means that the operation is
> fallible.  This one isn't, so could you name it "existingScript()"?

Setting needinfo so this todo doesn't get lost.
Flags: needinfo?(bhackett1024)
Depends on: 884194
No longer depends on: 883973
The function was renamed separately.
Flags: needinfo?(bhackett1024)
You need to log in before you can comment on or make changes to this bug.