Closed Bug 473070 Opened 15 years ago Closed 15 years ago

TM: "Assertion failure: StackBase(fp) + blockDepth == regs.sp - 1, at ../jsinterp.cpp"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: gkw, Unassigned)

Details

(Keywords: assertion, crash, testcase)

this.__proto__ = ([x = 1]);
for each (let y in [function(){}, '', function(){}, '']) { let (x) []; }

asserts debug at Assertion failure: StackBase(fp) + blockDepth == regs.sp - 1, at ../jsinterp.cpp:6729 but seems to work as expected in opt. TM-only.

Related to bug 472450?
Flags: wanted1.9.1?
function first(foo) { eval(foo); }
1e4.__proto__ = [[]]
first("for (var z = 0; z < 1; ++z) { for each (let y in [(1/0), (void 0), (1/0), (1/0), function(){}, (1/0), (1/0), (void 0), function(){}, (void 0)]) { let (x = [[]]) null; } } ");

causes a similar assertion in TM-debug shell but crashes at js_Interpret at null in opt TM.
assert also seen in js1_7/regress/regress-470388-02.js and js1_7/regress/regress-470388-03.js.
WFM TM tip, I'm suspecting the fix for bug 472450 probably fixed this bug too, though I'm not sure.
Status: NEW → RESOLVED
Closed: 15 years ago
Flags: in-testsuite?
Resolution: --- → WORKSFORME
Flags: wanted1.9.1?
You need to log in before you can comment on or make changes to this bug.