Last Comment Bug 326453 - JS_Assertion while decompiling
: JS_Assertion while decompiling
Status: VERIFIED FIXED
[rft-dl]
: assertion, verified1.8.0.2, verified1.8.1
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- normal (vote)
: mozilla1.9alpha1
Assigned To: Brendan Eich [:brendan]
:
Mentors:
Depends on:
Blocks: js1.6rc1
  Show dependency treegraph
 
Reported: 2006-02-08 12:21 PST by Blake Kaplan (:mrbkap)
Modified: 2006-07-07 21:16 PDT (History)
3 users (show)
brendan: blocking1.8.1+
dveditz: blocking1.8.0.2+
bob: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (821 bytes, patch)
2006-02-08 12:39 PST, Brendan Eich [:brendan]
mrbkap: review+
brendan: approval‑branch‑1.8.1+
dveditz: approval1.8.0.2+
Details | Diff | Splinter Review

Description Blake Kaplan (:mrbkap) 2006-02-08 12:21:26 PST
I noticed this while testing something else:

Given:
function f() { with({})function g() { }; print(); }

Trying to call f.toString() gives:
Assertion failure: top < ss->printer->script->depth, at jsopcode.c:646

Brendan tracked this down and should have a patch.
Comment 1 Brendan Eich [:brendan] 2006-02-08 12:39:26 PST
Created attachment 211171 [details] [diff] [review]
fix
Comment 2 Brendan Eich [:brendan] 2006-02-08 12:53:54 PST
Fixed.

/be
Comment 3 Bob Clary [:bc:] 2006-02-11 23:31:46 PST
Checking in regress-326453.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-326453.js,v  <--  regress-326453.js
Comment 4 Daniel Veditz [:dveditz] 2006-02-16 12:50:39 PST
Comment on attachment 211171 [details] [diff] [review]
fix

approved for 1.8.0 branch, a=dveditz for drivers
Comment 5 Brendan Eich [:brendan] 2006-02-22 12:46:42 PST
Fixed on branches.

/be
Comment 6 Bob Clary [:bc:] 2006-03-03 12:56:45 PST
v ff 1.8.0.1/1.8/1.9 win/linux/mac 2006030[12]

Note You need to log in before you can comment on or make changes to this bug.