Assertion failure: hasScript(), at jsfun.h

RESOLVED FIXED in mozilla24

Status

()

--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 2 bugs, {assertion, regression, testcase})

Trunk
mozilla24
x86_64
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 763223 [details]
stack

a = b = c = d = []
e = f = g = h = i = j = k = a[6] = {}
function x() {}
v = []
for (var p in this) {
    Array.prototype.some.call(a, (function() {
        y = Uint8ClampedArray.z
    }))
}

asserts js debug shell on m-c changeset 36da3cb92193 without any CLI arguments at Assertion failure: hasScript(), at jsfun.h

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ce43d28276e4
user:        Brian Hackett
date:        Fri Jun 14 05:58:28 2013 -0600
summary:     Bug 678037 - Enable lazy JS parsing and fix various bugs, r=waldo,evilpie,nobody.
Flags: needinfo?(bhackett1024)
(Assignee)

Comment 1

5 years ago
Created attachment 763237 [details] [diff] [review]
patch

When iterating over inlined Ion frames, the callee function may be lazily interpreted.  The script will exist, and the function just needs to be repointed to it.  This patch also cleans up some metastasis in the methods for getting scripts off functions, and adds a comment on how to use the remaining methods.
Assignee: general → bhackett1024
Attachment #763237 - Flags: review?(luke)
Flags: needinfo?(bhackett1024)

Updated

5 years ago
Blocks: 883560

Comment 3

5 years ago
https://hg.mozilla.org/mozilla-central/rev/91f620586eb8
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24

Comment 4

5 years ago
Comment on attachment 763237 [details] [diff] [review]
patch

Review of attachment 763237 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsfun.h
@@ +242,5 @@
>          JS_ASSERT(hasScript());
>          return u.i.s.script_;
>      }
>  
> +    inline JSScript *getExistingScript();

The usual naming convention is that "getX" means that the operation is fallible.  This one isn't, so could you name it "existingScript()"?
Attachment #763237 - Flags: review?(luke) → review+

Updated

5 years ago
Depends on: 883973
(Reporter)

Comment 5

5 years ago
(In reply to Luke Wagner [:luke] from comment #4)
> The usual naming convention is that "getX" means that the operation is
> fallible.  This one isn't, so could you name it "existingScript()"?

Setting needinfo so this todo doesn't get lost.
Flags: needinfo?(bhackett1024)

Updated

5 years ago
Depends on: 884194

Updated

5 years ago
No longer depends on: 883973
(Assignee)

Comment 6

5 years ago
The function was renamed separately.
(Assignee)

Updated

5 years ago
Flags: needinfo?(bhackett1024)
You need to log in before you can comment on or make changes to this bug.