947680 - Assertion failure: !empty(), at vm/Shape.h

Status: RESOLVED DUPLICATE of bug 947661

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: lldb stack

(function() {
    let x, y = let(z)(0)
    eval()
})()

asserts js debug shell on m-c changeset edac8cba9f78 with -D at Assertion failure: !empty(), at vm/Shape.h

My configure flags are:

CC="clang -Qunused-arguments" AR=ar CXX="clang++ -Qunused-arguments" sh ./configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache --enable-threadsafe <other NSPR options>

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/5bb192fc539e
user:        Brian Hackett
date:        Sat Dec 07 11:03:07 2013 -0800
summary:     Bug 944930 - Remove block index from aliasedvar ops, use a binary search to find the block chain for a given pc, r=luke.

Brian, is bug 944930 a likely regressor?