let(x)((function () { for (y in [x, x]) with({}); })()) asserts dbg js shell on TM branch without -j at Assertion failure: OBJ_SCOPE(pobj)->object == pobj, at ../jsinterp.cpp:444 autoBisect shows this is probably related to bug 503080 : The first bad revision is: changeset: 30378:3915e2d2c748 user: Jason Orendorff date: Tue Jul 21 16:25:11 2009 -0500 summary: Bug 503080 - Remove prototype-scope-sharing. r=brendan.

The assertion needs to be weakened. In this case `pobj` is a Block object, so it does actually share a scope. Before this patch, I guess the property was actually found on the Block's prototype. Now it is found on the Block itself. I think it would be nice if we could make Block-clones proto-less, but JSOP_LEAVEEXPR uses the proto: if (OBJ_GET_PROTO(cx, obj) == fp->blockChain) { ...js_PutBlockObject... }

Comment on attachment 390928 [details] [diff] [review] v1 Generally we don't compare == or != NULL (exception: when left operand is nested assignment expression in loop condition). Better yet, use JS_ASSERT_IF(OBJ_SCOPE(pobj)->object, OBJ_SCOPE(pobj)->object == pobj); r=me with that. /be

i had a js crash while running browser-chrome tests on Windows, applying this patch solved them. Here is the stack trace http://mozilla.pastebin.com/m1113c556

ps: the crash was persistent, i was able to reproduce it at every run, same point.

Correction: http://hg.mozilla.org/tracemonkey/rev/b8cc6ff9d6dc

Mass change: adding fixed1.9.2 keyword (This bug was identified as a mozilla1.9.2 blocker which was fixed before the mozilla-1.9.2 repository was branched (August 13th, 2009) as per this query: http://is.gd/2ydcb - if this bug is not actually fixed on mozilla1.9.2, please remove the keyword. Apologies for the bugspam)