452329 - "Assertion failure: *data->pc == JSOP_CALL || *data->pc == JSOP_NEW"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

./js
js> this.__defineGetter__("x", "".match); if (x) 3;

Assertion failure: *data->pc == JSOP_CALL || *data->pc == JSOP_NEW, at jsstr.cpp:1243

Affects both mozilla-central and tracemonkey branch, even without the "-j" option.  mrbkap touched the code near this assertion recently, in bug 450529.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

The code can't assume that we're on a call opcode as the testcase in this bug shows.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/a28e37f1058e

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This affects 1.9.0.x branch too.

Comment 5

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-452329.js,v  <--  regress-452329.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/576e250f78a4

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: patch portage to 1.9.0.x

This is a patch backport for the 1.9.0.x branch.

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 352991 [details] [diff] [review]
patch portage to 1.9.0.x

Approved for 1.9.0.6, a=dveditz for release-drivers.

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Gary, were you going to check this in to the 1.9.0 branch?

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #8)
> Gary, were you going to check this in to the 1.9.0 branch?

Nope, I don't have checkin privs.

Comment 10

[Robert Sayre]

Checked into CVS for 1.9.0.6

Checking in js/src/jsstr.c;
/cvsroot/mozilla/js/src/jsstr.c,v  <--  jsstr.c
new revision: 3.207; previous revision: 3.206
done

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Bob, can you verify this for 1.9.0.6?

Comment 12

[Bob Clary [:bc] (inactive)]

v 1.9.0, 1.9.1, 1.9.2