326453 - JS_Assertion while decompiling

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

I noticed this while testing something else:

Given:
function f() { with({})function g() { }; print(); }

Trying to call f.toString() gives:
Assertion failure: top < ss->printer->script->depth, at jsopcode.c:646

Brendan tracked this down and should have a patch.

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Brendan Eich [:brendan]]

Fixed.

/be

Comment 3

[Bob Clary [:bc] (inactive)]

Checking in regress-326453.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-326453.js,v  <--  regress-326453.js

Comment 4

[Daniel Veditz [:dveditz]]

Comment on attachment 211171 [details] [diff] [review]
fix

approved for 1.8.0 branch, a=dveditz for drivers

Comment 5

[Brendan Eich [:brendan]]

Fixed on branches.

/be

Comment 6

[Bob Clary [:bc] (inactive)]

v ff 1.8.0.1/1.8/1.9 win/linux/mac 2006030[12]