373827 - "Assertion failure: OBJ_GET_CLASS(cx, obj)->flags & JSCLASS_HAS_PRIVATE" or crash with let that binds nothing

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

debug
js> let ([] = [{x: function(){}}]) { }
Assertion failure: OBJ_GET_CLASS(cx, obj)->flags & JSCLASS_HAS_PRIVATE, at jsapi.c:2327

opt
js> let ([] = [{x: function(){}}]) { }; foo;
null deref [@ js_FindProperty]

Comment 1

[Brian Crowder]

I wonder if this is related to the kludge of treating lets as vars at the top-level (bug 346749)?  The object being supplied to js_PutBlockObject is the "global" object.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

That bug only deals with let declarations. Let statements aren't affected. This is more likely to be bug 361566, though I don't remember the exact reason for the failure.

Comment 3

[Jesse Ruderman]

Fixed by the checkin for bug 375695.

Comment 4

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_7/regress/regress-373827-01.js,v  <--  regress-373827-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_7/regress/regress-373827-02.js,v  <--  regress-373827-02.js
initial revision: 1.1

Comment 5

[Bob Clary [:bc] (inactive)]

verified fixed 1.9.0 linux/mac*/windows.