885934 - Assertion failure: !vp.isMagic(), at jsobj.cpp

Status: RESOLVED DUPLICATE of bug 885067

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function() {
    ('a'.replace(/a/, () => {
        eval("arguments")
    }));
})()

asserts js debug shell on m-c changeset 61c3c8b85563 with --baseline-eager --no-ti --no-ion at Assertion failure: !vp.isMagic(), at jsobj.cpp

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/bbf7ea6ef2e4
parent:      127428:ff681c5eadaf
parent:      125447:0bba6ba92467
user:        Jan de Mooij
date:        Wed Mar 20 12:54:47 2013 +0100
summary:     Merge from mozilla-central.

Not all ancestors of this changeset have been checked.
Use bisect --extend to continue the bisection from
the common ancestor, f7e1b97dcc73.

This iteration took 13.968 seconds to run.

Oops! We didn't test rev 0bba6ba92467, a parent of the blamed revision! Let's do that now.
Rev 0bba6ba92467: Updating... Compiling... Testing... [Uninteresting] It didn't crash. (0.042 seconds)
good (not interesting) 
As expected, the parent's label is the opposite of the blamed rev's label.

The bug was introduced by a merge (it was not present on either parent).
I don't know which patches from each side of the merge contributed to the bug. Sorry.

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision def4320f90aa).

Comment 3

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision cea75ce9a559).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/60d580712ec0
user:        Jason Orendorff
date:        Fri Jun 21 08:17:49 2013 -0500
summary:     Bug 852762 - Arrow functions are not automatically strict. Also fixes bug 885067. r=ejpbruel.

This iteration took 316.577 seconds to run.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jason, is bug 852762 a possible fix?

Comment 5

[Jason Orendorff [:jorendorff]]

It's definitely the fix. This is a dup of bug 885067 which is RESO FIXED. With tests!