Closed
Bug 473070
Opened 15 years ago
Closed 15 years ago
TM: "Assertion failure: StackBase(fp) + blockDepth == regs.sp - 1, at ../jsinterp.cpp"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: gkw, Unassigned)
Details
(Keywords: assertion, crash, testcase)
this.__proto__ = ([x = 1]); for each (let y in [function(){}, '', function(){}, '']) { let (x) []; } asserts debug at Assertion failure: StackBase(fp) + blockDepth == regs.sp - 1, at ../jsinterp.cpp:6729 but seems to work as expected in opt. TM-only. Related to bug 472450?
Flags: wanted1.9.1?
Reporter | ||
Comment 1•15 years ago
|
||
function first(foo) { eval(foo); } 1e4.__proto__ = [[]] first("for (var z = 0; z < 1; ++z) { for each (let y in [(1/0), (void 0), (1/0), (1/0), function(){}, (1/0), (1/0), (void 0), function(){}, (void 0)]) { let (x = [[]]) null; } } "); causes a similar assertion in TM-debug shell but crashes at js_Interpret at null in opt TM.
Comment 2•15 years ago
|
||
assert also seen in js1_7/regress/regress-470388-02.js and js1_7/regress/regress-470388-03.js.
Reporter | ||
Comment 3•15 years ago
|
||
WFM TM tip, I'm suspecting the fix for bug 472450 probably fixed this bug too, though I'm not sure.
Status: NEW → RESOLVED
Closed: 15 years ago
Flags: in-testsuite?
Resolution: --- → WORKSFORME
Reporter | ||
Updated•12 years ago
|
Flags: wanted1.9.1?
You need to log in
before you can comment on or make changes to this bug.
Description
•