498137 - TM: "Assertion failure: ((jsval) obj & JSVAL_TAGMASK) == JSVAL_OBJECT, at ../jsapi.h"

Status: RESOLVED DUPLICATE of bug 495962

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (z = 0; z < 1;) { (f = function(g) {
        for each(h in g) {
            const b = [];
            with(b) {
                for each(b in [0/0]) {}
            }
        }
    });
    f([0])
}

asserts with -j at Assertion failure: ((jsval) obj & JSVAL_TAGMASK) == JSVAL_OBJECT, at ../jsapi.h:118

Affects 1.9.1 branch with changeset 25953-3efd1ad9f6f7.

I have no idea if this is bad enough to block but nominating wanted first just-in-case.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 481989 :

The first bad revision is:
changeset:   25779:4c66b8ccb1b8
user:        Andreas Gal
date:        Sat Mar 07 01:25:37 2009 -0800
summary:     Check for non-stub getters/setters in SETNAME and SETPROP and invoke SetPropHit after setting the property in INITPROP (481989, r=brendan).

Sidenote: this assertion also occurs on Mac.

Comment 2

[Andreas Gal :gal]

This is not a dup.

Comment 3

[Andreas Gal :gal]

#2 is wrong. Its a dup after all. It goes into an endless loop now, which it also does with the interpreter. Resolving.