497146 - js1_5/extensions/regress-424942.js - Assertion failure: (int16) JSVAL_TO_INT(id) == JSVAL_TO_INT(id)

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Bob Clary [:bc] (inactive)]

js1_5/extensions/regress-424942.js shell linux so far.

Assertion failure: (int16) JSVAL_TO_INT(id) == JSVAL_TO_INT(id), at ../jsfun.cpp:1071

Comment 1

[Bob Clary [:bc] (inactive)]

oops. tracemonkey.

Comment 2

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/tracemonkey/rev/f08193a65af1
bug 496790 did this.

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix the assertbotch

This is a debug-only assertion botch, the non-DEBUG code does the right thing.

/be

Comment 4

[Brendan Eich [:brendan]]

http://hg.mozilla.org/tracemonkey/rev/61ac579284a2

/be

Comment 5

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Debug-only assertion is not a blocker, but is still welcome.

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/61ac579284a2

Comment 7

[Igor Bukanov]

Comment on attachment 382552 [details] [diff] [review]
fix the assertbotch

>diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
>@@ -1207,7 +1207,7 @@ call_resolve(JSContext *cx, JSObject *ob
>+            if (!CallPropertyOp(cx, obj, INT_TO_JSID((int16)slot), &v, JSCPK_VAR, JS_FALSE))

Nit: use int16(slot).

Comment 8

[Brendan Eich [:brendan]]

Nearby cast used C style, of course (since the code was written in 1.9 era) and the assertion does too. I'll clean up on trunk in another bug, opportunistically. Thanks,

/be

Comment 9

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/01f3e20fa8dd

Comment 10

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2 on mac intel.