Last Comment Bug 715682 - "Assertion failure: !isIndex(&dummy),"
: "Assertion failure: !isIndex(&dummy),"
Status: RESOLVED FIXED
js-triage-done
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla12
Assigned To: Jeff Walden [:Waldo] (remove +bmo to email)
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz 713183
  Show dependency treegraph
 
Reported: 2012-01-05 15:02 PST by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 14:11 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (2.61 KB, text/plain)
2012-01-05 15:02 PST, Gary Kwong [:gkw] [:nth10sd]
no flags Details
Patch and test (3.13 KB, patch)
2012-01-05 15:42 PST, Jeff Walden [:Waldo] (remove +bmo to email)
bhackett1024: review+
Details | Diff | Splinter Review

Description Gary Kwong [:gkw] [:nth10sd] 2012-01-05 15:02:49 PST
Created attachment 586239 [details]
stack

({set"0"(l){}})

asserts js debug shell on m-c changeset 10894668e37f without any CLI arguments at Assertion failure: !isIndex(&dummy),

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   83723:d0e3133d19e2
user:        Jeff Walden
date:        Tue Dec 27 02:27:02 2011 -0600
summary:     Bug 713183 - Make JSOP_*PROP and JSOP_*NAME store a PropertyName immediate, not a JSAtom immediate, and take advantage of this fact.  r=bhackett
Comment 1 Jeff Walden [:Waldo] (remove +bmo to email) 2012-01-05 15:42:34 PST
Created attachment 586255 [details] [diff] [review]
Patch and test

Hmm, I thought I had fixed this.  Guess not!
Comment 2 Jeff Walden [:Waldo] (remove +bmo to email) 2012-01-06 13:24:48 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/c2c541acf201
Comment 3 :Ms2ger (⌚ UTC+1/+2) 2012-01-07 11:37:20 PST
Comment on attachment 586255 [details] [diff] [review]
Patch and test

>--- /dev/null
>+++ b/js/src/tests/ecma_5/Expressions/object-literal-accessor-property-name.js
>@@ -0,0 +1,30 @@
>+// Any copyright is dedicated to the Public Domain.
>+// http://creativecommons.org/licenses/publicdomain/
>+
>+var gTestfile = 'object-literal-accessor-property-name.js';
>+//-----------------------------------------------------------------------------
>+var BUGNUMBER = 536472;
>+var summary =
>+  'ES5: { get x(v) { } } and { set x(v, v2) { } } should be syntax errors';

Is that right?
Comment 4 Jeff Walden [:Waldo] (remove +bmo to email) 2012-01-09 22:22:26 PST
Nope, not in the slightest.  Tasty, tasty copypasta with open sauce code...

https://hg.mozilla.org/integration/mozilla-inbound/rev/4bb7458176c4
Comment 5 Ed Morley [:emorley] 2012-01-10 11:51:41 PST
https://hg.mozilla.org/mozilla-central/rev/4bb7458176c4
Comment 6 Christian Holler (:decoder) 2013-01-19 14:11:41 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.