Closed Bug 701227 Opened 8 years ago Closed 8 years ago

"Assertion failure: (obj)->propertyCount() == 1,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla11
Tracking Status
firefox10 --- verified

People

(Reporter: gkw, Assigned: luke)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: js-triage-done [qa!])

Attachments

(2 files)

Attached file stack
String((function() {
    try {} catch (d) {
        let x
    }
}), "\
    try {} catch (d) {\
        let x\
    }\
")

asserts js debug shell on m-c changeset 4fb61ebbf8ff with patch v1 from bug 697279 without any CLI arguments at Assertion failure: (obj)->propertyCount() == 1,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   79903:a6c390aa3bf2
user:        Luke Wagner
date:        Mon Nov 07 11:46:25 2011 -0800
summary:     Bug 696813 - Simplify Decompile (r=waldo)
Attached patch fixSplinter Review
Of course let decl in a catch appends to the catch's block!
Assignee: general → luke
Attachment #573398 - Flags: review?(jwalden+bmo)
Attachment #573398 - Flags: review?(jwalden+bmo) → review+
Comment on attachment 573398 [details] [diff] [review]
fix

Low-risk fix; causes safe crash if exercised.
Attachment #573398 - Flags: approval-mozilla-aurora+
Attachment #573398 - Flags: approval-mozilla-aurora+ → approval-mozilla-aurora?
Whiteboard: js-triage-needed → js-triage-done
https://hg.mozilla.org/mozilla-central/rev/76c2eea70c45
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Attachment #573398 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Whiteboard: js-triage-done → js-triage-done [qa+]
Hi guys.
Can you please tell me how can I verify this bug?
Thanks.
Build a debug SpiderMonkey shell off the cset in comment 0, see assertion failure, build shell off cset in comment 5, no assertion.
I used the beta source with the latest revision (mozilla-beta-226c1a05e0b6) and built the js debug shell; then I run the test from comment #0 and no message was displayed. 
Is this what was needed to verify this issue?
Thanks!
(In reply to Mihaela Velimiroviciu [QA] from comment #8)
> I used the beta source with the latest revision (mozilla-beta-226c1a05e0b6)
> and built the js debug shell; then I run the test from comment #0 and no
> message was displayed. 
> Is this what was needed to verify this issue?
> Thanks!

I used Mac OS X 10.6
Status: RESOLVED → VERIFIED
Keywords: verified-beta
Whiteboard: js-triage-done [qa+] → js-triage-done [qa!]
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug701227.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.