Closed Bug 432091 Opened 16 years ago Closed 15 years ago

"Assertion failure: ss->sprinter.base[start] == '[' || ss->sprinter.base[start] == '#'" with trap, getter, watch

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: assertion, testcase) 

function f() { [1 for each (p in {x getter: watch})] }
trap(f, 0, "");
f();

Assertion failure: ss->sprinter.base[start] == '[' || ss->sprinter.base[start] == '#', at jsopcode.c:2804

In opt, execution stops, but nothing really bad seems to happen.
Igor's patch from bug 430293 comment #8 fixes this.
Depends on: 430293
WFM
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.