352613 - Assertions within js_ReportIsNotFunction involving switch, replace, map

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> switch(8) { case  1: a; case ('fafafa'.replace(/a/g, [1,2,3,4].map)): b; }
Assertion failure: top != 0, at jsopcode.c:816

js> switch(8) { case  7: a; case ('fafafa'.replace(/a/g, [1,2,3,4].map)): b; }
Assertion failure: sn && SN_TYPE(sn) == SRC_SWITCH, at jsopcode.c:2873

The only difference between the two inputs is the number in the first case.

This might just be demonstrating bug 351503, but I'm filing in case it's a real bug made visible by bug 351503.

Comment 1

[Jesse Ruderman]

With "prep patch for plan A" in bug 346642, the assertion is gone, and the error message is correct!

js> switch(8) { case 1: d; case ('fafafa'.replace(/a/g, [1,2,3,4].map)): b; }
typein:5: TypeError: "a" is not a function

Comment 2

[Jesse Ruderman]

Fixed on trunk because "prep patch for plan A, v9d" in bug 346642 was checked in.

Comment 3

[Bob Clary [:bc] (inactive)]

Checking in regress-352613-01.js;
/cvsroot/mozilla/js/tests/js1_6/Regress/regress-352613-01.js,v  <--  regress-352613-01.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_6/Regress/regress-352613-02.js,v
done
Checking in regress-352613-02.js;
/cvsroot/mozilla/js/tests/js1_6/Regress/regress-352613-02.js,v  <--  regress-352613-02.js
initial revision: 1.1
done

Comment 4

[Bob Clary [:bc] (inactive)]

I am not sure the test is adequate as it passes on 1.8 as well. Is this a trunk only regression?

verified fixed 1.9 20060919 windows/mac*/linux

Comment 5

[Bob Clary [:bc] (inactive)]

fixed by bug 346642 
verified fixed 20061203 windows/linux/mac*