Closed
Bug 352870
Opened 18 years ago
Closed 18 years ago
"Assertion failure: which < js_SrcNoteSpec[SN_TYPE(sn)].arity" [@ js_SetSrcNoteOffset] involving huge "case" expression
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: jruderman, Unassigned)
Details
(Keywords: testcase)
Steps to reproduce: paste one of these crazy huge testcases into the js shell and press enter. switch(4) { case [([11,12,13,14].v ? 2 : let (a=1,b=2) 5) for (c in [<x/> for (f in g)])]: } switch(4) { case [(let (y = [].j(5)) ({})) for (p in ([1,2,3,4].g).v({}, ((w).y(z, <x/>))))]: } Result: Assertion failure: which < js_SrcNoteSpec[SN_TYPE(sn)].arity, at jsemit.c:6493
Reporter | ||
Comment 1•18 years ago
|
||
Here's another assertion, involving some of the same craziness: function() { switch(3) { case ([<{z}></{z}>.([[1]]) for (x in ([j=k for (y in [1])]))]): } } Assertion failure: sn && SN_TYPE(sn) == SRC_PCDELTA, at jsopcode.c:3001
Reporter | ||
Comment 2•18 years ago
|
||
WFM with trunk plus the "prep patch for plan A, v6" patch in bug 346642.
Comment 3•18 years ago
|
||
WFM now: js> switch(4) { case [([11,12,13,14].v ? 2 : let (a=1,b=2) 5) for (c in [<x/> for(f in g)])]: } typein:1: ReferenceError: g is not defined js> switch(4) { case [(let (y = [].j(5)) ({})) for (p in ([1,2,3,4].g).v({},((w).y(z, <x/>))))]: } typein:2: TypeError: [1, 2, 3, 4].g has no properties Fixed by the "Prep patch for 'plan A' (bug 346642)"? /be
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Comment 4•18 years ago
|
||
Checking in regress-352870-01.js; /cvsroot/mozilla/js/tests/js1_7/regress/regress-352870-01.js,v <-- regress-352870-01.js initial revision: 1.1 done RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-352870-02.js,v done Checking in regress-352870-02.js; /cvsroot/mozilla/js/tests/js1_7/regress/regress-352870-02.js,v <-- regress-352870-02.js initial revision: 1.1 done RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-352870-03.js,v done Checking in regress-352870-03.js; /cvsroot/mozilla/js/tests/js1_7/regress/regress-352870-03.js,v <-- regress-352870-03.js initial revision: 1.1 done
Flags: in-testsuite+
Comment 5•18 years ago
|
||
verified fixed 1.9 20061007 windows/linux no assert in 1.8 though.
Status: RESOLVED → VERIFIED
You need to log in
before you can comment on or make changes to this bug.
Description
•