361571 - "Assertion failure: fp->scopeChain == parent" with watch, setter, eval

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Jesse Ruderman]

js> this.__defineSetter__('y', eval); this.watch('y', function () { return ""; }); y = 1;
Assertion failure: fp->scopeChain == parent, at jsfun.c:614

Seems harmless in opt.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Give the pseudo frame a scopeChain

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 246475 [details] [diff] [review]
Give the pseudo frame a scopeChain

This should go into 1.8.x branches.

/be

Comment 3

[Daniel Veditz [:dveditz]]

Comment on attachment 246475 [details] [diff] [review]
Give the pseudo frame a scopeChain

approved for 1.8/1.8.0 branches, a=dveditz for drivers

Comment 4

[Brendan Eich [:brendan]]

1.8 branch:   new revision: 3.56.2.12; previous revision: 3.56.2.11
1.8.0 branch: new revision: 3.56.2.1.4.6; previous revision: 3.56.2.1.4.5

Leaving open for mrbkap to commit to trunk (which is closed atm for 1.9alpha).

/be

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Fixed everywhere now.

Comment 6

[Bob Clary [:bc] (inactive)]

Checking in regress-361571.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-361571.js,v  <--  regress-361571.js
initial revision: 1.1
done

Comment 7

[Bob Clary [:bc] (inactive)]

verified fixed 20061201 1.8.0.9 windows/linux/mac*, 1.8.1.1 windows/linux/mac*, 1.9 windows/linux

Comment 8

[Bob Clary [:bc] (inactive)]

catch the indirect eval exception on trunk.

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-361571.js,v  <--  regress-361571.js
new revision: 1.3; previous revision: 1.2