If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

"Assertion failure: OBJ_GET_CLASS(cx, obj)->flags & JSCLASS_HAS_PRIVATE" or crash with let that binds nothing

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
11 years ago
10 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
x86
Mac OS X
crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

11 years ago
debug
js> let ([] = [{x: function(){}}]) { }
Assertion failure: OBJ_GET_CLASS(cx, obj)->flags & JSCLASS_HAS_PRIVATE, at jsapi.c:2327

opt
js> let ([] = [{x: function(){}}]) { }; foo;
null deref [@ js_FindProperty]

Comment 1

11 years ago
I wonder if this is related to the kludge of treating lets as vars at the top-level (bug 346749)?  The object being supplied to js_PutBlockObject is the "global" object.
That bug only deals with let declarations. Let statements aren't affected. This is more likely to be bug 361566, though I don't remember the exact reason for the failure.
Depends on: 361566
(Reporter)

Comment 3

11 years ago
Fixed by the checkin for bug 375695.
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Depends on: 375695
No longer depends on: 361566
Flags: in-testsuite?
Resolution: --- → FIXED

Comment 4

11 years ago
/cvsroot/mozilla/js/tests/js1_7/regress/regress-373827-01.js,v  <--  regress-373827-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_7/regress/regress-373827-02.js,v  <--  regress-373827-02.js
initial revision: 1.1
Flags: in-testsuite? → in-testsuite+
(Reporter)

Updated

11 years ago
No longer blocks: 349611
(Reporter)

Updated

11 years ago
Blocks: 349611

Comment 5

10 years ago
verified fixed 1.9.0 linux/mac*/windows.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.