The default bug view has changed. See this FAQ.

"Assertion failure: (obj)->propertyCount() == 1,"

VERIFIED FIXED in Firefox 10

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
5 years ago
4 years ago

People

(Reporter: gkw, Assigned: luke)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla11
x86
Mac OS X
assertion, regression, testcase, verified-beta
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox10 verified)

Details

(Whiteboard: js-triage-done [qa!])

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 573361 [details]
stack

String((function() {
    try {} catch (d) {
        let x
    }
}), "\
    try {} catch (d) {\
        let x\
    }\
")

asserts js debug shell on m-c changeset 4fb61ebbf8ff with patch v1 from bug 697279 without any CLI arguments at Assertion failure: (obj)->propertyCount() == 1,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   79903:a6c390aa3bf2
user:        Luke Wagner
date:        Mon Nov 07 11:46:25 2011 -0800
summary:     Bug 696813 - Simplify Decompile (r=waldo)
(Assignee)

Comment 1

5 years ago
Created attachment 573398 [details] [diff] [review]
fix

Of course let decl in a catch appends to the catch's block!
Assignee: general → luke
Attachment #573398 - Flags: review?(jwalden+bmo)
Attachment #573398 - Flags: review?(jwalden+bmo) → review+
(Assignee)

Comment 2

5 years ago
Comment on attachment 573398 [details] [diff] [review]
fix

Low-risk fix; causes safe crash if exercised.
Attachment #573398 - Flags: approval-mozilla-aurora+
(Assignee)

Updated

5 years ago
Attachment #573398 - Flags: approval-mozilla-aurora+ → approval-mozilla-aurora?
(Assignee)

Updated

5 years ago
Whiteboard: js-triage-needed → js-triage-done
(Assignee)

Comment 3

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/76c2eea70c45
Target Milestone: --- → mozilla11
https://hg.mozilla.org/mozilla-central/rev/76c2eea70c45
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED

Updated

5 years ago
Attachment #573398 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
(Assignee)

Comment 5

5 years ago
https://hg.mozilla.org/releases/mozilla-aurora/rev/497f95c08395
(Assignee)

Updated

5 years ago
status-firefox10: --- → fixed
Whiteboard: js-triage-done → js-triage-done [qa+]

Comment 6

5 years ago
Hi guys.
Can you please tell me how can I verify this bug?
Thanks.
(Assignee)

Comment 7

5 years ago
Build a debug SpiderMonkey shell off the cset in comment 0, see assertion failure, build shell off cset in comment 5, no assertion.
I used the beta source with the latest revision (mozilla-beta-226c1a05e0b6) and built the js debug shell; then I run the test from comment #0 and no message was displayed. 
Is this what was needed to verify this issue?
Thanks!
(In reply to Mihaela Velimiroviciu [QA] from comment #8)
> I used the beta source with the latest revision (mozilla-beta-226c1a05e0b6)
> and built the js debug shell; then I run the test from comment #0 and no
> message was displayed. 
> Is this what was needed to verify this issue?
> Thanks!

I used Mac OS X 10.6
Status: RESOLVED → VERIFIED
status-firefox10: fixed → verified
Keywords: verified-beta
Whiteboard: js-triage-done [qa+] → js-triage-done [qa!]
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug701227.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.