349624 - "let" in initial-value expression for another "let" causes assertion [@ js_Interpret]: "!fp->blockChain || OBJ_GET_PARENT(cx, obj) == fp->blockChain"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Steps to reproduce:
  javascript:let(y = let (x) 4) 3

Result:
  Assertion failure: !fp->blockChain || OBJ_GET_PARENT(cx, obj) == fp->blockChain, at /Users/admin/trunk/mozilla/js/src/jsinterp.c:5920

Comment 1

[Brendan Eich [:brendan]]

Dup of bug 349605.  We can't nest scopes and pop the scope chain at compile time without doing the same at runtime.  But, we shouldn't open the outer scope early when there's no need to nest the inner one at runtime.

/be

*** This bug has been marked as a duplicate of 349605 ***

Comment 2

[Jesse Ruderman]

Reopening: bug 349605 is fixed but this still asserts.

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix

Comment 4

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 5

[Bob Clary [:bc] (inactive)]

Checking in regress-349624.js;
/cvsroot/mozilla/js/tests/js1_7/expressions/regress-349624.js,v  <--  regress-349624.js
initial revision: 1.1

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060831 windows/mac*/linux

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 236181 [details] [diff] [review]
fix

a=beltzner on behalf of 181drivers

Comment 8

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 2006090118 windows/mac*/linux