416460 - "Assertion failure: SCOPE_GET_PROPERTY(OBJ_SCOPE(pobj), ATOM_TO_JSID(atom))"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

This script triggers an assertion failure in debug jsshell and debug Firefox.  In opt jsshell, nothing bad seems to happen.  The assertion is part of code added in bug 365851.

/a/.__proto__.__proto__ = { "2": 3 };
var b = /b/;
b["2"];
b["2"];

Assertion failure: SCOPE_GET_PROPERTY(OBJ_SCOPE(pobj), ATOM_TO_JSID(atom)), at jsinterp.c:333

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix bogus assertion

May as well share the wealth from jsobj.c via jsobj.h, use it to avoid the bogus assertion.

/be

Comment 2

[Brendan Eich [:brendan]]

This is only a bogus assertion. Nothing goes wrong in release builds.

/be

Comment 3

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 302432 [details] [diff] [review]
fix bogus assertion

r=shaver

Comment 4

[Brendan Eich [:brendan]]

Fixed:

js/src/jsinterp.c 3.420
js/src/jsobj.c 3.427
js/src/jsobj.h 3.84

/be

Comment 5

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-416460.js,v  <--  regress-416460.js
initial revision: 1.1

Comment 6

[Bob Clary [:bc] (inactive)]

v