521163 - "Assertion failure: OBJ_GET_CLASS(cx, obj) != &js_BlockClass, at ../jsobj.cpp" with defineGetter, eval

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (c in [0]) {
    let(c = __defineGetter__("", function(){})) {
        eval("function w(){}")++
    }
}

asserts js debug shell on TM tip at Assertion failure: OBJ_GET_CLASS(cx, obj) != &js_BlockClass, at ../jsobj.cpp:4559 without -j.

autoBisecting soon...

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 519129:

The first bad revision is:
changeset:   33294:eec5815b761f
user:        Blake Kaplan
date:        Tue Sep 29 10:03:42 2009 -0700
summary:     Fix Zimbra indirect eval crash. r=brendan

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Seems WFM now. Blake, fixed by bug 523530?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Nope, not bug 523530.

autoBisect shows this is probably fixed by bug 522123:

The first bad revision is:
changeset:   34049:64094cb2f8b2
user:        Jim Blandy
date:        Wed Oct 21 14:34:55 2009 -0700
summary:     Bug 522123: Don't reify lazy scope chain blocks twice in 'eval'. r=mrbkap

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jesse suggests resolving this "fixed" over IRC, since the fixing patch was also landed on m-c.

Comment 5

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929