Closed Bug 351795 Opened 18 years ago Closed 18 years ago

"Assertion failure: top < ss->printer->script->depth"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
PowerPC
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: crash, testcase) 

js> p={}; (p.z = [1].some(function(y) { return y > 0; }) ? 4 : [6])(5);
Assertion failure: top < ss->printer->script->depth, at jsopcode.c:709
Bus error
#0  0x00009650 in JS_Assert (s=0x120a7c "top < ss->printer->script->depth", file=0x120964 "jsopcode.c", ln=709) at jsutil.c:58
#1  0x0002f840 in PushOff (ss=0xbfffd8dc, off=103, op=JSOP_PUSHOBJ) at jsopcode.c:709
#2  0x00039968 in Decompile (ss=0xbfffd8dc, pc=0x5041eb "9Y>X", nb=101) at jsopcode.c:3159
#3  0x00039b84 in js_DecompileCode (jp=0x504220, script=0x503c40, pc=0x5041b0 ";", len=101) at jsopcode.c:3212
#4  0x0003ad70 in js_DecompileValueGenerator (cx=0x500180, spindex=-8, v=25188098, fallback=0x1804c28) at jsopcode.c:3567
#5  0x000525c4 in js_ReportIsNotFunction (cx=0x500180, vp=0x1816a44, flags=0) at jsfun.c:2251
#6  0x0008d94c in NoSuchMethod (cx=0x500180, fp=0xbfffe6b0, vp=0x1816a44, flags=0, argcp=0xbfffde10) at jsinterp.c:717
#7  0x000a12b0 in js_Interpret (cx=0x500180, pc=0x503cff ":", result=0xbfffe6d0) at jsinterp.c:3898
Depends on: 350417
WFM now, guessing this was fixed by the patch in 350417.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → WORKSFORME
But see 352609; there are other ways to hit this assertion.
Flags: in-testsuite?
/cvsroot/mozilla/js/tests/js1_6/Regress/regress-351795.js,v  <--  regress-351795.js
initial revision: 1.1
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.