352185 - "Assertion failure: !fp->blockChain || OBJ_GET_PARENT(cx, obj) == fp->blockChain" involving switch and let

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

js> switch(let (a) 2) { case 0: let b; }
Assertion failure: !fp->blockChain || OBJ_GET_PARENT(cx, obj) == fp->blockChain, at jsinterp.c:5980

#0  0x0000a410 in JS_Assert
#1  0x000ae554 in js_Interpret (cx=0x500180, pc=0x503383 "?", result=0xbfffe6b0) at jsinterp.c:5979
#2  0x0009040c in js_Execute (cx=0x500180, chain=0x1804ec0, script=0x503350, down=0x0, flags=0, result=0xbfffe7e0) at jsinterp.c:1621
#3  0x000218b8 in JS_ExecuteScript (cx=0x500180, obj=0x1804ec0, script=0x503350, rval=0xbfffe7e0) at jsapi.c:4256
#4  0x00003424 in Process (cx=0x500180, obj=0x1804ec0, filename=0x0, forceTTY=0) at js.c:265
#5  0x00003fec in ProcessArgs (cx=0x500180, obj=0x1804ec0, argv=0xbffff9c8, argc=2) at js.c:486
#6  0x0000a37c in main (argc=2, argv=0xbffff9c8, envp=0xbffff9d4) at js.c:3086

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Brendan Eich [:brendan]]

Fixed on trunk.

Checking in jsemit.c;
/cvsroot/mozilla/js/src/jsemit.c,v  <--  jsemit.c
new revision: 3.208; previous revision: 3.207
done

/be

Comment 3

[Mike Schroepfer]

Comment on attachment 237931 [details] [diff] [review]
fix

a=schrep for 181drivers for JS crash.

Comment 4

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 5

[Bob Clary [:bc] (inactive)]

Checking in regress-352185.js;
/cvsroot/mozilla/js/tests/js1_7/block/regress-352185.js,v  <--  regress-352185.js
initial revision: 1.1
done

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 20060914 windows/linux 1.9 20060914 windows/mac*/linux