Closed
Bug 672153
Opened 13 years ago
Closed 13 years ago
TI: "Assertion failure: ss->top >= 2,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, testcase)
uneval(Function("[] = (*::*++);print(x);"));
asserts js debug shell on JM changeset 7f471e15146e without any CLI arguments at Assertion failure: ss->top >= 2, does not seem to assert on MC changeset da362a07a5ee
|
||
Comment 1•13 years ago
|
||
There was a case where element inc/dec ops could be emitted for XML names, and the emitted bytecode was malformed. Pretty sure this code wasn't covered by any tests. http://hg.mozilla.org/projects/jaegermonkey/rev/ed0911cf98f2
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
|
||
Comment 2•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/e4x/bug672153.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•