352008 - Decompiling for([k,v] in o) causes "Assertion failure: strcmp(rval, forelem_cookie) == 0"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> (function() { for each([k, v] in o) { } })
Assertion failure: strcmp(rval, forelem_cookie) == 0, at jsopcode.c:2057

#0  0x00009558 in JS_Assert
#1  0x00034be0 in Decompile (ss=0xbfffe18c, pc=0x503313 "z\f?7l", nb=36) at jsopcode.c:2057
#2  0x00039b24 in js_DecompileCode (jp=0x503390, script=0x5032d0, pc=0x503300 "?;", len=36) at jsopcode.c:3226
#3  0x00039d08 in js_DecompileScript (jp=0x503390, script=0x5032d0) at jsopcode.c:3246
#4  0x0003a430 in js_DecompileFunction (jp=0x503390, fun=0x1808238) at jsopcode.c:3354
#5  0x0002088c in JS_DecompileFunction (cx=0x500180, fun=0x1808238, indent=0) at jsapi.c:4222
#6  0x0004f860 in js_fun_toString (cx=0x500180, obj=0x1805490, indent=0, argc=0, argv=0x1816220, rval=0xbfffe498) at jsfun.c:1476
#7  0x0004f8f8 in fun_toString (cx=0x500180, obj=0x1805490, argc=0, argv=0x1816220, rval=0xbfffe498) at jsfun.c:1486
#8  0x0008e81c in js_Invoke (cx=0x500180, argc=0, flags=2) at jsinterp.c:1372
...

Comment 1

[Brendan Eich [:brendan]]

Repeat after me: destructuring decompilation isn't working yet. ;-)

/be

Comment 2

[Brendan Eich [:brendan]]

Should this be linked to the fuzzer bug?

/be

Comment 3

[Jesse Ruderman]

I didn't find it using the fuzzer, but I do have a line in the fuzzer commented out to avoid hitting it.  It doesn't really matter assuming the fix for bug 346642 will fix this.

Comment 4

[Jesse Ruderman]

Fixed on trunk because "prep patch for plan A, v9d" in bug 346642 was checked in.

The decompilation is still way wrong, but Brendan is working on that along with the rest of destructuring decompilation.

Comment 5

[Bob Clary [:bc] (inactive)]

Checking in regress-352008.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-352008.js,v  <--  regress-352008.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/browser.js,v
done
Checking in browser.js;
/cvsroot/mozilla/js/tests/js1_7/regress/browser.js,v  <--  browser.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/shell.js,v
done
Checking in shell.js;
/cvsroot/mozilla/js/tests/js1_7/regress/shell.js,v  <--  shell.js
initial revision: 1.1
done

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060921 windows/mac*/linux since no assert but the test fails due to the decompilation errors.