459630 - TM: "Assertion failure: JSVAL_TAG(v) == JSVAL_STRING"

Status: VERIFIED WORKSFORME

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

(function(){ [].__proto__.u = void 0; for (let y in [5,6,7,8]) y = NaN; })()

Assertion failure: JSVAL_TAG(v) == JSVAL_STRING, at jstracer.cpp:1334

Comment 1

[Bob Clary [:bc] (inactive)]

same assertion, essentially same test in js1_7/regress/regress-452703.js

regressed by http://hg.mozilla.org/mozilla-central/rev/186b4ce768ec (bug 459537).

Comment 2

[Andreas Gal :gal]

Thanks for bisecting.

Comment 4

[Jason Orendorff [:jorendorff]]

Still crashing.  "let" is not the culprit:

for(y in [0,1,2]) y = NaN;
Assertion failure: JSVAL_TAG(v) == JSVAL_STRING, at jstracer.cpp:1334

Comment 5

[Andreas Gal :gal]

Added test-case.

http://hg.mozilla.org/tracemonkey/rev/d40d1098f7aa

Comment 6

[Jesse Ruderman]

I think you should add these to the bottom of the test function, so the test doesn't pollute the global namespace and [].__proto__.

delete [].__proto__.u;
delete y;

Comment 7

[Jesse Ruderman]

I found another testcase that still triggers this assertion.  See bug 461590.

Comment 8

[Bob Clary [:bc] (inactive)]

v 1.9.1

Comment 9

[Bob Clary [:bc] (inactive)]

added to js1_8_1/trace/trace-test.js