419803 - "Assertion failure: sprop->parent == scope->lastProp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

js> for (var i=0; i<2; ++i) ({ p: 5, p: 7 });
Assertion failure: sprop->parent == scope->lastProp, at jsinterp.c:5946

This is a recent regression.  I'm guessing it's a regression from bug 129496, since the assertion was added there.

I convinced myself that this seems harmless in opt builds using a slightly more complicated script that checks the constructed objects.  In opt builds, it outputs "({p:7})" twice; in debug builds, it outputs "({p:7})" once and then asserts.

function g() { for (var i=0; i<2; ++i) yield ({ p: 5, p: 7 }); }
var iter = g();
print(uneval(iter.next()));
print(uneval(iter.next()));

Comment 1

[Brendan Eich [:brendan]]

Easy to fix, benign (a strict warning). Must fix assertions pronto.

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: take the slow path if we detect a dup

Comment 3

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 305962 [details] [diff] [review]
take the slow path if we detect a dup

r=shaver

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 305962 [details] [diff] [review]
take the slow path if we detect a dup

There may be more bad here, need to write a test. But we don't need the assertbotch in b4.

/be

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 305962 [details] [diff] [review]
take the slow path if we detect a dup

a1.9b4=beltzner

Comment 6

[Brendan Eich [:brendan]]

Fixed:

js/src/jsinterp.c 3.447

/be

Comment 7

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-419803.js,v  <--  regress-419803.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_7/regress/regress-419803.js,v  <--  regress-419803.js
initial revision: 1.1

Comment 8

[Bob Clary [:bc] (inactive)]

v