Last Comment Bug 701227 - "Assertion failure: (obj)->propertyCount() == 1,"
: "Assertion failure: (obj)->propertyCount() == 1,"
Status: VERIFIED FIXED
js-triage-done [qa!]
: assertion, regression, testcase, verified-beta
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
: -- critical (vote)
: mozilla11
Assigned To: Luke Wagner [:luke]
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz 696813
  Show dependency treegraph
 
Reported: 2011-11-09 16:18 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:31 PST (History)
9 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
verified


Attachments
stack (6.33 KB, text/plain)
2011-11-09 16:18 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
fix (1.45 KB, patch)
2011-11-09 18:09 PST, Luke Wagner [:luke]
jwalden+bmo: review+
asa: approval‑mozilla‑aurora+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2011-11-09 16:18:28 PST
Created attachment 573361 [details]
stack

String((function() {
    try {} catch (d) {
        let x
    }
}), "\
    try {} catch (d) {\
        let x\
    }\
")

asserts js debug shell on m-c changeset 4fb61ebbf8ff with patch v1 from bug 697279 without any CLI arguments at Assertion failure: (obj)->propertyCount() == 1,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   79903:a6c390aa3bf2
user:        Luke Wagner
date:        Mon Nov 07 11:46:25 2011 -0800
summary:     Bug 696813 - Simplify Decompile (r=waldo)
Comment 1 Luke Wagner [:luke] 2011-11-09 18:09:00 PST
Created attachment 573398 [details] [diff] [review]
fix

Of course let decl in a catch appends to the catch's block!
Comment 2 Luke Wagner [:luke] 2011-11-09 18:31:28 PST
Comment on attachment 573398 [details] [diff] [review]
fix

Low-risk fix; causes safe crash if exercised.
Comment 4 Marco Bonardo [::mak] 2011-11-11 02:26:06 PST
https://hg.mozilla.org/mozilla-central/rev/76c2eea70c45
Comment 6 Vlad [QA] 2012-01-03 06:00:00 PST
Hi guys.
Can you please tell me how can I verify this bug?
Thanks.
Comment 7 Luke Wagner [:luke] 2012-01-03 08:36:20 PST
Build a debug SpiderMonkey shell off the cset in comment 0, see assertion failure, build shell off cset in comment 5, no assertion.
Comment 8 Mihaela Velimiroviciu (:mihaelav) 2012-01-27 06:32:37 PST
I used the beta source with the latest revision (mozilla-beta-226c1a05e0b6) and built the js debug shell; then I run the test from comment #0 and no message was displayed. 
Is this what was needed to verify this issue?
Thanks!
Comment 9 Mihaela Velimiroviciu (:mihaelav) 2012-01-27 06:34:27 PST
(In reply to Mihaela Velimiroviciu [QA] from comment #8)
> I used the beta source with the latest revision (mozilla-beta-226c1a05e0b6)
> and built the js debug shell; then I run the test from comment #0 and no
> message was displayed. 
> Is this what was needed to verify this issue?
> Thanks!

I used Mac OS X 10.6
Comment 10 Christian Holler (:decoder) 2013-01-14 08:31:50 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug701227.js.

Note You need to log in before you can comment on or make changes to this bug.