752205 - Assertion failure: v.toString()->isAtom(), at ../frontend/BytecodeEmitter.h:547

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central revision 032d43b1770f (no options required):


for (d in [(1000), 0]) {
    const a = (d += (this).toString())
}
eval("switch(b) { case a: }");

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

jsfunfuzz found this too - reproduced on 64-bit Mac OS X 10.7.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   92788:6dbb135d3f1f
user:        Luke Wagner
date:        Tue May 01 14:01:06 2012 -0700
summary:     Bug 749617 - rm XDRState::codeString (r=njn,a=not-libxul)

Comment 2

[Luke Wagner [:luke]]

Attachment: fix and test

Ah, const vars as case labels allow raw values hence non-atomized strings.

Thanks for the test case!

Comment 3

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bce99efec425

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/bce99efec425

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug752205.js.