Closed Bug 464092 Opened 16 years ago Closed 16 years ago

"Assertion failure: OBJ_IS_CLONED_BLOCK(obj)" with string.replace, "let"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: jruderman, Assigned: mrbkap)

Details

(4 keywords)

Attachments

(1 file, 1 obsolete file)

js> let (a) 'b'.replace(/b/g, function() { c = this; }); c.d = 3; c.d;
Assertion failure: OBJ_IS_CLONED_BLOCK(obj), at ../jsobj.cpp:2115

While I was trying to simplify the testcase further, I ran into this odd error message:

js> let (a) 'b'.replace(/b/g, function() c = this );
typein:1: TypeError: can't convert Block to string

I tried applying what I learned in bug 452913 comment 9, but wasn't able to eliminate string.replace from the testcase.

Testing tracemonkey branch, but without -j.
Attached patch Fix (obsolete) — Splinter Review
This seems to do it -- the same way we censor access to call objects when they're used as |this|, we need to censor access to block objects.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #349079 - Flags: review?(igor)
Attached patch FixSplinter Review
Apparently, hg qnew -f doesn't generate the patch file until you explicitly qrefresh.
Attachment #349079 - Attachment is obsolete: true
Attachment #349080 - Flags: review?(igor)
Attachment #349079 - Flags: review?(igor)
Attachment #349080 - Flags: review?(igor) → review+
Nominating for the releases. I am not sure if the bug exists on 1.8.1, will need to check this.
Flags: blocking1.9.1?
Flags: blocking1.9.0.6?
Attachment #349080 - Flags: approval1.9.1?
Flags: blocking1.9.1? → blocking1.9.1+
Attachment #349080 - Flags: approval1.9.1? → approval1.9.1+
Checkin message: Bug 464092 - Censor access to block objects when they're the parents of functions. r=igor
Flags: blocking1.9.0.6? → blocking1.9.0.6+
http://hg.mozilla.org/mozilla-central/rev/1c9730e3ae64
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Blake, this still needs to land in 1.9.1, right? And does this patch apply to 1.9.0?
Whiteboard: [needs 1.9.1 checkin][needs 1.9.0 patch]
Attachment #349080 - Flags: approval1.9.0.6?
Comment on attachment 349080 [details] [diff] [review]
Fix

Yeah, this applies.
Whiteboard: [needs 1.9.1 checkin][needs 1.9.0 patch] → [needs 1.9.1 checkin]
Comment on attachment 349080 [details] [diff] [review]
Fix

Approved for 1.9.0.6, a=dveditz for release-drivers.
Attachment #349080 - Flags: approval1.9.0.6? → approval1.9.0.6+
Checked into the 1.9.0 branch.
Keywords: fixed1.9.0.6
http://hg.mozilla.org/tracemonkey/rev/ad45bf9010b6
/cvsroot/mozilla/js/tests/js1_8/regress/regress-464092-01.js,v  <--  regress-464092-01.js
initial revision: 1.1
/cvsroot/mozilla/js/tests/js1_8/regress/regress-464092-02.js,v  <--  regress-464092-02.js
initial revision: 1.1
Flags: in-testsuite+
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: