Last Comment Bug 326453 - JS_Assertion while decompiling
: JS_Assertion while decompiling
: assertion, verified1.8.0.2, verified1.8.1
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
-- normal (vote)
: mozilla1.9alpha1
Assigned To: Brendan Eich [:brendan]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: js1.6rc1
  Show dependency treegraph
Reported: 2006-02-08 12:21 PST by Blake Kaplan (:mrbkap)
Modified: 2006-07-07 21:16 PDT (History)
3 users (show)
brendan: blocking1.8.1+
dveditz: blocking1.8.0.2+
bob: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

fix (821 bytes, patch)
2006-02-08 12:39 PST, Brendan Eich [:brendan]
mrbkap: review+
brendan: approval‑branch‑1.8.1+
dveditz: approval1.8.0.2+
Details | Diff | Splinter Review

Description User image Blake Kaplan (:mrbkap) 2006-02-08 12:21:26 PST
I noticed this while testing something else:

function f() { with({})function g() { }; print(); }

Trying to call f.toString() gives:
Assertion failure: top < ss->printer->script->depth, at jsopcode.c:646

Brendan tracked this down and should have a patch.
Comment 1 User image Brendan Eich [:brendan] 2006-02-08 12:39:26 PST
Created attachment 211171 [details] [diff] [review]
Comment 2 User image Brendan Eich [:brendan] 2006-02-08 12:53:54 PST

Comment 3 User image Bob Clary [:bc:] 2006-02-11 23:31:46 PST
Checking in regress-326453.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-326453.js,v  <--  regress-326453.js
Comment 4 User image Daniel Veditz [:dveditz] 2006-02-16 12:50:39 PST
Comment on attachment 211171 [details] [diff] [review]

approved for 1.8.0 branch, a=dveditz for drivers
Comment 5 User image Brendan Eich [:brendan] 2006-02-22 12:46:42 PST
Fixed on branches.

Comment 6 User image Bob Clary [:bc:] 2006-03-03 12:56:45 PST
v ff win/linux/mac 2006030[12]

Note You need to log in before you can comment on or make changes to this bug.