346203 - destructuring assignment |var {b:{c:x}}={b:{c:1}}| crashes [@ FindPropertyValue]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Nickolay_Ponomarev]

Running var {b:{c:x}}={b:{c:1}} in xpcshell crashes a recent trunk build:

FindPropertyValue(pn=0x03711580, pnid=0x03711440, data=0x0012eb44)  Line 1805
CheckDestructuring(cx=0x0364acc0, args=0x0012ebc4, left=0x03711418, right=0x03711580, tc=0x0012ece4)  Line 1894
Variables(cx=0x0364acc0, ts=0x03711070, tc=0x0012ece4)  Line 3220
Statement(cx=0x0364acc0, ts=0x03711070, tc=0x0012ece4)  Line 2896
Statements(cx=0x0364acc0, ts=0x03711070, tc=0x0012ece4)  Line 1131
js_ParseTokenStream(cx=0x0364acc0, chain=0x03756e10, ts=0x03711070)  Line 451
JS_BufferIsCompilableUnit(cx=0x0364acc0, obj=0x03756e10, bytes=0x0012eddc, length=0x00000018)  Line 3935
ProcessFile(cx=0x0364acc0, obj=0x03756e10, filename=0x00000000, file=0x10310bd0, forceTTY=0x00000000)  Line 624
Process(cx=0x0364acc0, obj=0x03756e10, filename=0x00000000, forceTTY=0x00000000)  Line 674
ProcessArgs(cx=0x0364acc0, obj=0x03756e10, argv=0x003f7064, argc=0x00000000)  Line 829
main(argc=0x00000000, argv=0x003f7064, envp=0x003f2dd0)  Line 1103

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Typo'd pnprop for pnhit, d'oh.

This should get automatic 1.8.1 approval.

/be

Comment 2

[Brendan Eich [:brendan]]

Fixed on trunk and 1.8 branch.

/be

Comment 3

[Bob Clary [:bc] (inactive)]

Checking in browser.js;
/cvsroot/mozilla/js/tests/js1_7/expressions/browser.js,v  <--  browser.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/expressions/shell.js,v
done
Checking in shell.js;
/cvsroot/mozilla/js/tests/js1_7/expressions/shell.js,v  <--  shell.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/expressions/regress-346203.js,v
done
Checking in regress-346203.js;
/cvsroot/mozilla/js/tests/js1_7/expressions/regress-346203.js,v  <--  regress-346203.js
initial revision: 1.1
done

Comment 4

[Nickolay_Ponomarev]

verified with a self-built trunk.

Comment 5

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.1, 1.9 win/mac(ppc|tell)/linux 20060728