352267 - "Assertion failure: jp->sprinter.base[offset+0] == ' '" [@ SetDontBrace] with if, block, let

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> uneval(function() { if (y) { { let set = 4.; } } else if (<x/>) { } })
Assertion failure: jp->sprinter.base[offset+0] == ' ', at jsopcode.c:651

#0  0x00009bb0 in JS_Assert
#1  0x0002fb70 in SetDontBrace (jp=0x603ea0) at jsopcode.c:651
#2  0x000328f0 in Decompile (ss=0xbfffd3cc, pc=0x60342f "Q?", nb=7) at jsopcode.c:1520
#3  0x00032fb0 in Decompile (ss=0xbfffd3cc, pc=0x603426 "?", nb=13) at jsopcode.c:1615
#4  0x000346a4 in Decompile (ss=0xbfffd3cc, pc=0x603423 "\a", nb=31) at jsopcode.c:1902
#5  0x0003a8ac in js_DecompileCode (jp=0x603ea0, script=0x6033f0, pc=0x603420 ";", len=31) at jsopcode.c:3373
#6  0x0003aa90 in js_DecompileScript (jp=0x603ea0, script=0x6033f0) at jsopcode.c:3393
#7  0x0003b1b8 in js_DecompileFunction (jp=0x603ea0, fun=0x1808268) at jsopcode.c:3501
#8  0x00020ee4 in JS_DecompileFunction (cx=0x600180, fun=0x1808268, indent=32768) at jsapi.c:4222
...

Comment 1

[Brendan Eich [:brendan]]

Forthcoming patch in bug 352217 fixes this.

/be

Comment 2

[Brendan Eich [:brendan]]

Fixed now by patch for bug 352217.

/be

Comment 3

[Bob Clary [:bc] (inactive)]

Checking in regress-352267.js;
/cvsroot/mozilla/js/tests/js1_7/block/regress-352267.js,v  <--  regress-352267.js
initial revision: 1.1
done

Comment 4

[Bob Clary [:bc] (inactive)]

oops.

Checking in regress-352267.js;
/cvsroot/mozilla/js/tests/js1_7/block/regress-352267.js,v  <--  regress-352267.js
new revision: 1.2; previous revision: 1.1
done

Comment 5

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060914 windows/mac*/linux
bug not evident on 1.8...