701227 - "Assertion failure: (obj)->propertyCount() == 1,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

String((function() {
    try {} catch (d) {
        let x
    }
}), "\
    try {} catch (d) {\
        let x\
    }\
")

asserts js debug shell on m-c changeset 4fb61ebbf8ff with patch v1 from bug 697279 without any CLI arguments at Assertion failure: (obj)->propertyCount() == 1,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   79903:a6c390aa3bf2
user:        Luke Wagner
date:        Mon Nov 07 11:46:25 2011 -0800
summary:     Bug 696813 - Simplify Decompile (r=waldo)

Comment 1

[Luke Wagner [:luke]]

Attachment: fix

Of course let decl in a catch appends to the catch's block!

Comment 2

[Luke Wagner [:luke]]

Comment on attachment 573398 [details] [diff] [review]
fix

Low-risk fix; causes safe crash if exercised.

Comment 3

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/76c2eea70c45

Comment 4

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/76c2eea70c45

Comment 5

[Luke Wagner [:luke]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/497f95c08395

Comment 6

[Vlad [QA]]

Hi guys.
Can you please tell me how can I verify this bug?
Thanks.

Comment 7

[Luke Wagner [:luke]]

Build a debug SpiderMonkey shell off the cset in comment 0, see assertion failure, build shell off cset in comment 5, no assertion.

Comment 8

[Mihaela Velimiroviciu (:mihaelav)]

I used the beta source with the latest revision (mozilla-beta-226c1a05e0b6) and built the js debug shell; then I run the test from comment #0 and no message was displayed. 
Is this what was needed to verify this issue?
Thanks!

Comment 9

[Mihaela Velimiroviciu (:mihaelav)]

(In reply to Mihaela Velimiroviciu [QA] from comment #8)
> I used the beta source with the latest revision (mozilla-beta-226c1a05e0b6)
> and built the js debug shell; then I run the test from comment #0 and no
> message was displayed. 
> Is this what was needed to verify this issue?
> Thanks!

I used Mac OS X 10.6

Comment 10

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug701227.js.