Closed Bug 350692 Opened 13 years ago Closed 13 years ago

import x['y']['z']; causes "Assertion failure: pn->pn_op == JSOP_GETELEM" [@ EmitElemOp]

Categories

(Core :: JavaScript Engine, defect, critical)

PowerPC
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: jruderman, Assigned: brendan)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase, verified1.8.1)

Crash Data

Attachments

(1 file)

javascript:import x['y']['z'];

Assertion failure: pn->pn_op == JSOP_GETELEM, 
at [@ EmitElemOp] jsemit.c:2343
Attached patch fix assertionSplinter Review
r=me for assertion fix.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #236150 - Flags: review+
Fixed on trunk and 1.8 branch.

/be
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Keywords: fixed1.8.1
Resolution: --- → FIXED
Checking in regress-350692.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-350692.js,v  <--  regress-350692.js
initial revision: 1.1
Flags: in-testsuite+
verified fixed 1.8, 1.9 20060831 windows/mac*/linux

tweaked test to catch undefined x exception

Checking in regress-350692.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-350692.js,v  <--  regress-350692.js
new revision: 1.2; previous revision: 1.1
Status: RESOLVED → VERIFIED
Or you could fake up x = {y: {z: function (){}}}; and import that, but you'd then get a TypeError: x["y"]["z"] is not exported -- could be easier to catch while avoiding catching and ignoring other exceptions that should not be ignored, in case there's a regression.

/be
Checking in regress-350692.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-350692.js,v  <--  regress-350692.js
new revision: 1.3; previous revision: 1.2
done

Thanks for the pointer.
Crash Signature: [@ EmitElemOp]
You need to log in before you can comment on or make changes to this bug.