Closed Bug 352870 Opened 18 years ago Closed 18 years ago

"Assertion failure: which < js_SrcNoteSpec[SN_TYPE(sn)].arity" [@ js_SetSrcNoteOffset] involving huge "case" expression

Categories

(Core :: JavaScript Engine, defect)

PowerPC
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: jruderman, Unassigned)

Details

(Keywords: testcase)

Steps to reproduce: paste one of these crazy huge testcases into the js shell and press enter.

switch(4) { case [([11,12,13,14].v ? 2 : let (a=1,b=2) 5) for (c in [<x/> for (f in g)])]: }

switch(4) { case [(let (y = [].j(5)) ({})) for (p in ([1,2,3,4].g).v({}, ((w).y(z, <x/>))))]: }

Result:

Assertion failure: which < js_SrcNoteSpec[SN_TYPE(sn)].arity, at jsemit.c:6493
Here's another assertion, involving some of the same craziness:

function() { switch(3) { case ([<{z}></{z}>.([[1]]) for (x in ([j=k for (y in [1])]))]): } }

Assertion failure: sn && SN_TYPE(sn) == SRC_PCDELTA, at jsopcode.c:3001
WFM with trunk plus the "prep patch for plan A, v6" patch in bug 346642.
WFM now:

js> switch(4) { case [([11,12,13,14].v ? 2 : let (a=1,b=2) 5) for (c in [<x/> for(f in g)])]: }
typein:1: ReferenceError: g is not defined
js> switch(4) { case [(let (y = [].j(5)) ({})) for (p in ([1,2,3,4].g).v({},((w).y(z, <x/>))))]: }
typein:2: TypeError: [1, 2, 3, 4].g has no properties

Fixed by the "Prep patch for 'plan A' (bug 346642)"?

/be
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Checking in regress-352870-01.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-352870-01.js,v  <--  regress-352870-01.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-352870-02.js,v
done
Checking in regress-352870-02.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-352870-02.js,v  <--  regress-352870-02.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_7/regress/regress-352870-03.js,v
done
Checking in regress-352870-03.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-352870-03.js,v  <--  regress-352870-03.js
initial revision: 1.1
done
Flags: in-testsuite+
verified fixed 1.9 20061007 windows/linux no assert in 1.8 though.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.