506347 - Assertion failure: OBJ_SCOPE(pobj)->object == pobj, at ../jsinterp.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

let(x)((function () {
    for (y in [x, x]) with({});
})())

asserts dbg js shell on TM branch without -j at Assertion failure: OBJ_SCOPE(pobj)->object == pobj, at ../jsinterp.cpp:444

autoBisect shows this is probably related to bug 503080 :

The first bad revision is:
changeset:   30378:3915e2d2c748
user:        Jason Orendorff
date:        Tue Jul 21 16:25:11 2009 -0500
summary:     Bug 503080 - Remove prototype-scope-sharing. r=brendan.

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: v1

The assertion needs to be weakened.

In this case `pobj` is a Block object, so it does actually share a scope. Before this patch, I guess the property was actually found on the Block's prototype.  Now it is found on the Block itself.

I think it would be nice if we could make Block-clones proto-less, but JSOP_LEAVEEXPR uses the proto: 

  if (OBJ_GET_PROTO(cx, obj) == fp->blockChain) {
      ...js_PutBlockObject...
  }

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 390928 [details] [diff] [review]
v1

Generally we don't compare == or != NULL (exception: when left operand is nested assignment expression in loop condition).

Better yet, use JS_ASSERT_IF(OBJ_SCOPE(pobj)->object, OBJ_SCOPE(pobj)->object == pobj);

r=me with that.

/be

Comment 3

[Marco Bonardo [:mak]]

i had a js crash while running browser-chrome tests on Windows, applying this patch solved them.
Here is the stack trace
http://mozilla.pastebin.com/m1113c556

Comment 4

[Marco Bonardo [:mak]]

ps: the crash was persistent, i was able to reproduce it at every run, same point.

Comment 5

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/09c5ef592b5f

Comment 6

[Jason Orendorff [:jorendorff]]

Correction: http://hg.mozilla.org/tracemonkey/rev/b8cc6ff9d6dc

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/b8cc6ff9d6dc

Comment 8

[Mike Beltzner [:beltzner, not reading bugmail]]

Mass change: adding fixed1.9.2 keyword

(This bug was identified as a mozilla1.9.2 blocker which was fixed before the mozilla-1.9.2 repository was branched (August 13th, 2009) as per this query: http://is.gd/2ydcb - if this bug is not actually fixed on mozilla1.9.2, please remove the keyword. Apologies for the bugspam)