429266 - Assertion failure with "let", trap(), DVG

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

function f() { let (a) 1; null.x; }
trap(f, 0, "");
f()

Assertion failure: nuses == 0 || *pcstack[pcdepth - 1] == JSOP_ENTERBLOCK, at jsopcode.c:5175

Comment 1

[Brian Crowder]

This is fixed by my WIP patch from bug 422137.

Comment 2

[Bob Clary [:bc] (inactive)]

Attachment: js1_7/extensions/regress-429266.js

Comment 3

[Bob Clary [:bc] (inactive)]

not fixed. passes in browser but not shell.

Comment 4

[Bob Clary [:bc] (inactive)]

of course, trap isn't supported in the browser. duh. this was on linux 64bit and I rm'd the obj dirs to make sure they built ok to confirm the assert was still there.

Comment 5

[Brian Crowder]

Yeah, thanks bc.  Not sure why I thought this one was fixed by the patch from bug 422137.  Also, not sure what the equivalent of trap() is for the browser.

Comment 6

[Brian Crowder]

Fixed by bug 431465's patch.

Comment 7

[Brian Crowder]

Bug 431465 has landed, please reopen if this crash persists.

Comment 8

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_7/extensions/regress-429266.js,v  <--  regress-429266.js
initial revision: 1.1

changeset:   15653:c6248d1bd02d