355049 - decompilation of for..in destructuring into two holes causes "Assertion failure: pos != 0"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Jesse Ruderman]

js> function () { [3 for ([, , ] in null)] }
js> 

js> function () { [3 for each ([, , ] in null)] }
js> 

In a debug build, I get "Assertion failure: pos != 0, at jsopcode.c:2512".

Comment 1

[Jesse Ruderman]

This is slightly different, in that the *initial value*, rather than the thing being destructured into, is two holes.  Is this the same bug?

js> for(var [[[]], x] = [,,] in {}) { }
Assertion failure: j < n, at jsopcode.c:1133

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

Empty destructurers are allowed per the ES4 proposal, so JSOP_ARRAYPUSH's decompiler must cope.

/be

Comment 3

[Brendan Eich [:brendan]]

(In reply to comment #1)
> This is slightly different, in that the *initial value*, rather than the thing
> being destructured into, is two holes.  Is this the same bug?
> 
> js> for(var [[[]], x] = [,,] in {}) { }
> Assertion failure: j < n, at jsopcode.c:1133

Different bug, please file separately.

/be

Comment 4

[Jesse Ruderman]

Comment 1 is now bug 355660.

Comment 5

[Brendan Eich [:brendan]]

Checking in jsopcode.c;
/cvsroot/mozilla/js/src/jsopcode.c,v  <--  jsopcode.c
new revision: 3.191; previous revision: 3.190
done

/be

Comment 6

[Bob Clary [:bc] (inactive)]

Checking in regress-355049-01.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-355049-01.js,v  <--  regress-355049-01.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-355049-02.js,v
done
Checking in regress-355049-02.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-355049-02.js,v  <--  regress-355049-02.js
initial revision: 1.1
done

Comment 7

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20061007 windows/linux

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 241425 [details] [diff] [review]
fix

approved for 1.8 branch, a=dveditz for drivers

Comment 9

[Brendan Eich [:brendan]]

Fixed on 1.8 branch:

Checking in jsopcode.c;
/cvsroot/mozilla/js/src/jsopcode.c,v  <--  jsopcode.c
new revision: 3.89.2.64; previous revision: 3.89.2.63
done

/be

Comment 10

[Bob Clary [:bc] (inactive)]

verified fixed 20061122 1.8.1.1 windows/linux/mac*, 1.9 windows/linux