var a = #1=[#1#]; with ({}) { var b; } Assertion failure: JSVAL_IS_VOID(lval), at ../jsops.cpp:3476 Testing using TM branch rev 5b05b75cd402.

autoBisect shows this is probably related to bug 514981: The first bad revision is: changeset: 32201:c19b0d06d076 user: Brendan Eich date: Wed Sep 09 20:21:15 2009 -0700 summary: Bug 514981 - JSStackFrame::sharp{Array,Depth} should be locals allocated due to #n[#=] usage (r=igor).

(In reply to comment #2) > Created an attachment (id=440707) [details] > proposed fix This was checked in to TM, thanks Brendan! http://hg.mozilla.org/tracemonkey/rev/1af19eedbde2

This is causing the following test to fail: var o = { p: 1 }; with (o) { var p = 2; } assertEq(o.p, 2); Three failures total, but the second's fallout from the first, and the third is likely duplicative of the first, as far as the eventual fix is likely concerned. REFTEST TEST-UNEXPECTED-FAIL | file:///builds/slave/tracemonkey-macosx-debug-unittest-jsreftest/build/jsreftest/tests/jsreftest.html?test=js1_5/Scope/regress-185485.js | Section 2 of test - Expected value '2', Actual value '1' item 2 REFTEST TEST-UNEXPECTED-FAIL | file:///builds/slave/tracemonkey-macosx-debug-unittest-jsreftest/build/jsreftest/tests/jsreftest.html?test=js1_5/Scope/regress-185485.js | Section 3 of test - Expected value '2', Actual value '1' item 3 REFTEST TEST-UNEXPECTED-FAIL | file:///builds/slave/tracemonkey-macosx-debug-unittest-jsreftest/build/jsreftest/tests/jsreftest.html?test=js1_5/Scope/regress-185485.js | Section 5 of test - Expected value 'function () {NL}', Actual value '0' item 5

backed out: http://hg.mozilla.org/tracemonkey/rev/f1bc91ce880e

This was backed out of tm. /be

oops, sorry.

http://hg.mozilla.org/tracemonkey/rev/5ef421117c44 /be