Closed
Bug 352009
Opened 18 years ago
Closed 18 years ago
array comprehension causes "Assertion failure: pn->pn_op != JSOP_NOP"
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.8.1
People
(Reporter: jruderman, Assigned: brendan)
References
Details
(Keywords: regression, testcase, verified1.8.1)
Attachments
(1 file)
1.10 KB,
patch
|
mrbkap
:
review+
mtschrep
:
approval1.8.1+
|
Details | Diff | Splinter Review |
js> [1 for (y in [3])] Assertion failure: pn->pn_op != JSOP_NOP, at jsemit.c:4177 #0 0x00009558 in JS_Assert #1 0x00062c20 in js_EmitTree (cx=0x500180, cg=0xbfffe5a8, pn=0x1814a10) at jsemit.c:4177 #2 0x000677dc in js_EmitTree (cx=0x500180, cg=0xbfffe5a8, pn=0x18153e0) at jsemit.c:5778 #3 0x00067c88 in js_EmitTree (cx=0x500180, cg=0xbfffe5a8, pn=0x1815310) at jsemit.c:5875 #4 0x0006544c in js_EmitTree (cx=0x500180, cg=0xbfffe5a8, pn=0x1814b00) at jsemit.c:5056 #5 0x000d5d6c in Statements (cx=0x500180, ts=0x1815010, tc=0xbfffe5a8) at jsparse.c:1470 #6 0x000d32a0 in js_CompileTokenStream (cx=0x500180, chain=0x1804ec0, ts=0x1815010, cg=0xbfffe5a8) at jsparse.c:501 #7 0x0001f6a8 in CompileTokenStream (cx=0x500180, obj=0x1804ec0, ts=0x1815010, tempMark=0x5001c8, eofp=0x0) at jsapi.c:3842 #8 0x0001fa00 in JS_CompileUCScriptForPrincipals (cx=0x500180, obj=0x1804ec0, principals=0x0, chars=0x502de0, length=19, filename=0x11a3a0 "typein", lineno=1) at jsapi.c:3937 ...
Assignee | ||
Comment 1•18 years ago
|
||
This is dumb. It's due to the patch for bug 350793. I'd like to fix it ASAP. /be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #237583 -
Flags: review?(mrbkap)
Attachment #237583 -
Flags: approval1.8.1?
Assignee | ||
Updated•18 years ago
|
OS: Mac OS X 10.4 → All
Priority: -- → P1
Hardware: Macintosh → All
Target Milestone: --- → mozilla1.8.1
Comment 2•18 years ago
|
||
Comment on attachment 237583 [details] [diff] [review] fix regression This seems trivial enough that my mildly impaired judgment shouldn't invalidate my reviewing ability ;-)
Attachment #237583 -
Flags: review?(mrbkap) → review+
Assignee | ||
Comment 3•18 years ago
|
||
Fixed on trunk. /be
Status: ASSIGNED → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Comment 4•18 years ago
|
||
Comment on attachment 237583 [details] [diff] [review] fix regression a=schrep for js fix.
Attachment #237583 -
Flags: approval1.8.1? → approval1.8.1+
Comment 6•18 years ago
|
||
Checking in js1_5/Regress/regress-352009.js; /cvsroot/mozilla/js/tests/js1_5/Regress/regress-352009.js,v <-- regress-352009.js initial revision: 1.1 done
Flags: in-testsuite+
Comment 7•18 years ago
|
||
verified fixed 1.8 20060914 windows/linux 1.9 20060914 windows/mac*/linux
Status: RESOLVED → VERIFIED
Keywords: fixed1.8.1 → verified1.8.1
You need to log in
before you can comment on or make changes to this bug.
Description
•