"Assertion failure: OBJ_GET_CLASS(cx, obj) != &js_BlockClass, at ../jsobj.cpp" with defineGetter, eval

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
8 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

(Reporter)

Description

8 years ago
for (c in [0]) {
    let(c = __defineGetter__("", function(){})) {
        eval("function w(){}")++
    }
}

asserts js debug shell on TM tip at Assertion failure: OBJ_GET_CLASS(cx, obj) != &js_BlockClass, at ../jsobj.cpp:4559 without -j.

autoBisecting soon...
(Reporter)

Comment 1

8 years ago
autoBisect shows this is probably related to bug 519129:

The first bad revision is:
changeset:   33294:eec5815b761f
user:        Blake Kaplan
date:        Tue Sep 29 10:03:42 2009 -0700
summary:     Fix Zimbra indirect eval crash. r=brendan
Blocks: 519129
(Reporter)

Comment 2

8 years ago
Seems WFM now. Blake, fixed by bug 523530?
(Reporter)

Comment 3

8 years ago
Nope, not bug 523530.

autoBisect shows this is probably fixed by bug 522123:

The first bad revision is:
changeset:   34049:64094cb2f8b2
user:        Jim Blandy
date:        Wed Oct 21 14:34:55 2009 -0700
summary:     Bug 522123: Don't reify lazy scope chain blocks twice in 'eval'. r=mrbkap
Whiteboard: fixed-in-tracemonkey
(Reporter)

Updated

8 years ago
Flags: in-testsuite?
(Reporter)

Comment 4

8 years ago
Jesse suggests resolving this "fixed" over IRC, since the fixing patch was also landed on m-c.
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.