20160 - Assertion failure: atom, at jsopcode.c:1656

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Robert Ginda]

An erroneous function in chatzilla crashed the js engine.  The engine was
attempting to decompile the function to report the error.

Brendan says,
"recent changes clone
 function objects often, and the clone is a lightweight who
 shares its prototype (the clone-parent) scope until it's used in a
 for/in loop, or in certain eval cases, that set a local varthen the
 lightweight clone gets its own scope, with just one (!) var in it,
 the one set by the for/in or eval the decompiler was not looking in the
 prototype for args and vars -- it thought the function scope was 'flat'
 or self-contained"

Comment 1

[Brendan Eich [:brendan]]

Attachment: proposed fix

Comment 2

[Brendan Eich [:brendan]]

Fix checked in.

/be