368224 - "Assertion failure: pnprop->pn_type == TOK_COLON" or crash [@ CheckDestructuring] with sharp declaration

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

js> ({ x: [] }) = #3={}
Assertion failure: pnprop->pn_type == TOK_COLON, at jsparse.c:2065

In opt, instead of an assertion failure, I get a null-deref crash [@ CheckDestructuring].

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Trivially correct.

/be

Comment 2

[Igor Bukanov]

Comment on attachment 263417 [details] [diff] [review]
fix

>Index: jsparse.c
>===================================================================
>RCS file: /cvsroot/mozilla/js/src/jsparse.c,v
>retrieving revision 3.277
>diff -p -u -8 -r3.277 jsparse.c
>--- jsparse.c	10 Apr 2007 13:29:10 -0000	3.277
>+++ jsparse.c	2 May 2007 01:49:01 -0000
>@@ -2046,31 +2046,34 @@ FindPropertyValue(JSParseNode *pn, JSPar

There is a loop that fills the table at the end of FindPropertyValue. Should it also skip the first pn when it is a defsharp?

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix, v2

Ugh, should have seen that. Not sure about the worth of this hashing code, but separate bug if need be.

/be

Comment 4

[Brendan Eich [:brendan]]

Fixed on trunk:

js/src/jsparse.c 3.278

/be

Comment 5

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_7/extensions/regress-368224.js,v  <--  regress-368224.js
initial revision: 1.1

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.9.0 linux/mac* 2007-05-05 shell.