Closed Bug 355105 Opened 13 years ago Closed 13 years ago

"Assertion failure: count > 0" with "catch([] if true)"

Categories

(Core :: JavaScript Engine, defect, critical)

PowerPC
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: jruderman, Assigned: brendan)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase, verified1.8.1.1, Whiteboard: js1.7)

Attachments

(1 file)

js> try { } catch([] if true) { } catch(x) { }
Assertion failure: count > 0, at jsemit.c:4737

Appears to be harmless in opt builds.
I'll check this into the trunk.  It should go into 1.8.1.1 and the js1.7src release.

/be
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #240946 - Flags: review+
Fixed on trunk:

Checking in jsemit.c;
/cvsroot/mozilla/js/src/jsemit.c,v  <--  jsemit.c
new revision: 3.218; previous revision: 3.217
done

/be
Blocks: js1.7src
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Flags: blocking1.8.1.1?
Resolution: --- → FIXED
Checking in regress-355105.js;
/cvsroot/mozilla/js/tests/js1_7/lexical/regress-355105.js,v  <--  regress-355105.js
initial revision: 1.1
done
Flags: in-testsuite+
verified fixed 1.9 20061003 windows/linux
Status: RESOLVED → VERIFIED
Flags: blocking1.8.1.1? → blocking1.8.1.1+
Whiteboard: js1.7
Comment on attachment 240946 [details] [diff] [review]
update assertion to allow empty destructuring

approved for 1.8 branch, a=dveditz for drivers
Attachment #240946 - Flags: approval1.8.1.1+
Fixed on the 1.8 branch:

Checking in jsemit.c;
/cvsroot/mozilla/js/src/jsemit.c,v  <--  jsemit.c
new revision: 3.128.2.57; previous revision: 3.128.2.56
done

/be
Keywords: fixed1.8.1.1
verified fixed 20061122 1.8.1.1 windows/linux/mac*, 1.9 windows/linux
No longer blocks: 349611
Blocks: 349611
You need to log in before you can comment on or make changes to this bug.