Assertion failure: (0 < (((JSScope *)(obj)->map))->u.count && (((JSScope *)(obj)->map))->u.count <= 4) || SCOPE_IS_SEALED(((JSScope *)(obj)->map)), at jsobj.c:3195 It fails, in this case, because scope->u.count == 5 and the scope is not sealed. The attachment is a gdb log showing this. To reproduce: 1. Apply the two patches in bug 404879 (attachment 301599 [details] [diff] [review] and attachment 302224 [details] [diff] [review], as of this writing) and the one in bug 402898. :-P 2. Build with XCFLAGS=JS_DEBUG_SCOPE_LOCKS 3. See the attachment for the command line to run the test. (BTW, in the attachment, in response to "print SCOPE_IS_SEALED((JSScope *)obj->map)", gdb can expand that macro because I hacked config.mk to compile with -g3 instead of -g.)

Many thanks to Jason for finding (he pointed out the stale comment removed here too, want to get that in ASAP). /be

Comment on attachment 302250 [details] [diff] [review] fix, plus comment and warning tweak r=shaver.

Fixed: js/src/jsinterp.c 3.419 Anything else in a new bug, but I hope this is it. /be

My tests pass.

This should be in-testsuite, given that Jason's shell-based test failed for want of the fix. Right? /be

I figured the test would be added as part of bug 404879 and I could mark this as - to get it off my radar.

Oh, ok -- sorry, didn't mean to meddle -- figured we could have an exact regression test for this bug that referenced its number, though. /be