350529 - x--' causes "Assertion failure: ts->lookahead < NTOKENS_MASK" [@ js_UngetToken]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
  In a debug build,
  javascript:x--'

Result:
  Assertion failure: ts->lookahead < NTOKENS_MASK 
  jsscan.c:2080 [@ js_UngetToken]

Expected:
  "Unterminated string literal" error.

Comment 1

[Brendan Eich [:brendan]]

Did the fix for bug 350415 regress this?

/be

Comment 2

[Brendan Eich [:brendan]]

I can't reproduce this in any js shell, trunk, 1.8 branch, 1.8.0 branch.  Jesse, Bob: can either of you?

/be

Comment 3

[Jesse Ruderman]

Yes, I can reproduce in trunk js shell.

> ~/trunk/mozilla/js/src/Darwin_DBG.OBJ admin$ ./js
js> x--'
Assertion failure: ts->lookahead < NTOKENS_MASK, at jsscan.c:2080
Abort trap

Comment 4

[Brendan Eich [:brendan]]

Attachment: fix

Jesse, can you test this?  It matches the change made for bug 350415.

/be

Comment 5

[Brendan Eich [:brendan]]

I should have seen this -- I did protest that the change for bug 350415 was gonna break something, playing Cassandra a bit.  This needs to go in for 1.8 to fix the regression that the patch for bug 350415 landed there yesterday.

/be

Comment 6

[Jesse Ruderman]

This patch fixes the bug for me.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 235878 [details] [diff] [review]
fix

I thought about this, but managed to convince myself that this code already looked like this.

Comment 8

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 9

[Mike Schroepfer]

Comment on attachment 235878 [details] [diff] [review]
fix

a=schrep for drivers.

Comment 10

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 11

[Bob Clary [:bc] (inactive)]

Checking in regress-350529.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-350529.js,v  <--  regress-350529.js
initial revision: 1.1

Comment 12

[Bob Clary [:bc] (inactive)]

verified fixed 1.8, 1.9 20060830 windows/mac*/linux also passes in 1.8.0.7