344139 - Assertion on executing (function(){let x=5; x+=x; return x;})();

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jeff Walden [:Waldo]]

Spun off from bug 344131...

Comment 1

[Jeff Walden [:Waldo]]

Attachment: The full testcase that crashes

Comment 2

[Bob Clary [:bc] (inactive)]

another midair:

Checking in regress-344139.js;
/cvsroot/mozilla/js/tests/js1_7/block/regress-344139.js,v  <--  regress-344139.js
initial revision: 1.1

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

We need to use the right opcode...

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 228705 [details] [diff] [review]
Fix

r=me, nominating for beta.

/be

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 6

[Brendan Eich [:brendan]]

Attachment: comment addition I mentioned to mrbkap

This should go into the 1.8 branch along with the "Fix" patch itself.

/be

Comment 7

[Brendan Eich [:brendan]]

Comment on attachment 228717 [details] [diff] [review]
comment addition I mentioned to mrbkap

Comment change checked into trunk too.

/be

Comment 8

[Bob Clary [:bc] (inactive)]

test covered in js1_7/block/regress-344139.js

Comment 9

[Bob Clary [:bc] (inactive)]

mrbkap: Can you please check this into 1.8 today? Thanks.

verified fixed trunk windows/mac(ppc|tel)/linux 20060723

Comment 10

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 windows/mac(ppc|tel)/linux 20060728

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

Fixed on the 1.8 branch.

Comment 12

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 windows/mac(ppc|tel)/linux 20060803