351497 - "for(let (w) x in y)" causes "Assertion failure: !TOKEN_TYPE_IS_DECL(tt) || pn1->pn_type == tt" [@ Statement]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> for(let (w) x in y) { } 
Assertion failure: !TOKEN_TYPE_IS_DECL(tt) || pn1->pn_type == tt, at jsparse.c:2767

#0  0x0000978c in JS_Assert
#1  0x000d93b4 in Statement (cx=0x500180, ts=0x1814a10, tc=0xbfffe6fc) at jsparse.c:2767
#2  0x000d4fc8 in Statements (cx=0x500180, ts=0x1814a10, tc=0xbfffe6fc) at jsparse.c:1418
#3  0x000d2590 in js_ParseTokenStream (cx=0x500180, chain=0x1804ec0, ts=0x1814a10) at jsparse.c:451
#4  0x0001fb0c in JS_BufferIsCompilableUnit (cx=0x500180, obj=0x1804ec0, bytes=0xbfffe824 "for(let (w) x in y) { } \n", length=25) at jsapi.c:3968
#5  0x00002754 in Process (cx=0x500180, obj=0x1804ec0, filename=0x0, forceTTY=0) at js.c:257
#6  0x000033ac in ProcessArgs (cx=0x500180, obj=0x1804ec0, argv=0xbffff9fc, argc=0) at js.c:486
#7  0x000096f8 in main (argc=0, argv=0xbffff9fc, envp=0xbffffa00) at js.c:3081

Comment 1

[Brendan Eich [:brendan]]

Regression from fix for bug 350991 -- assertion points to obvious fix.  Sorry I missed it.

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

Taking the liberty of marking r+mrbkap.

/be

Comment 3

[Brendan Eich [:brendan]]

I fixed this on the trunk and 1.8 branch -- force majeure.

/be

Comment 4

[Bob Clary [:bc] (inactive)]

Checking in regress-351497.js;
/cvsroot/mozilla/js/tests/js1_7/block/regress-351497.js,v  <--  regress-351497.js
initial revision: 1.1

Comment 5

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 1.9 2006090707 windows/mac*/linux