Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Description • 15 years ago

(eval("\
  function () {\
    for (var[x] = function(){} in \
      (function m(a) {\
        if (a < 1) {\
          x;\
          return\
        }\
        return m(a - 1) + m(a - 2)\
      })(7)\
      (eval(\"\"))\
    )\
    ([])\
  }\
"))()


asserts js debug shell with -j on TM tip at Assertion failure: JSOP_NAME variable found in outer trace, at ../jstracer.cpp:3303, js opt shell does not seem to crash.

autoBisect shows this is probably related to bug 495331:

The first bad revision is:
changeset:   37046:910ee7db07de
user:        David Mandelin
date:        Fri Jan 15 11:32:14 2010 -0800
summary:     Bug 495331: trace JSOP_LAMBDA for non-heavyweight, non-null closures, r=jorendorff,dvander

	David Mandelin [:dmandelin] Assignee
	Comment 1 • 15 years ago

Looks like a line of code that was supposed to be moved got copied instead. Probably a rebasing error or the like. Patch comes with a free comment update.

	David Mandelin [:dmandelin] Assignee
	Comment 3 • 15 years ago

http://hg.mozilla.org/tracemonkey/rev/cb79eb2076f2

	Robert Sayre
	Comment 4 • 15 years ago

http://hg.mozilla.org/mozilla-central/rev/cb79eb2076f2

	Christian Holler (:decoder)
	Comment 5 • 12 years ago

A testcase for this bug was automatically identified at js/src/jit-test/tests/closures/bug540136.js.