Closed Bug 374713 Opened 18 years ago Closed 18 years ago

"Assertion failure: (((*(sn2) >> 3) >= SRC_XDELTA) ? SRC_XDELTA : *(sn2) >> 3) == SRC_HIDDEN" decompiling catch with destructuring

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: jruderman, Assigned: igor)

References

Details

(Keywords: crash, regression, testcase) 

This is a recent regression.

js> function() { try { } catch([]) { } }
Assertion failure: (((*(sn2) >> 3) >= SRC_XDELTA) ? SRC_XDELTA : *(sn2) >> 3) == SRC_HIDDEN, at jsopcode.c:2391

Thread 0 Crashed:
0   js 	0x000c6e64 JS_Assert + 70 (jsutil.c:60)
1   js 	0x0008b8aa Decompile + 12413 (jsopcode.c:2391)
2   js 	0x000931a3 js_DecompileCode + 492 (jsopcode.c:4236)
3   js 	0x00093b5c js_DecompileFunction + 1891 (jsopcode.c:4434)
4   js 	0x00019f9e JS_DecompileFunction + 104 (jsapi.c:4178)
5   js 	0x0004f3c0 js_fun_toString + 494 (jsfun.c:1528)
6   js 	0x0004f424 fun_toString + 53 (jsfun.c:1539)
7   js 	0x00057dbb js_Invoke + 2954 (jsinterp.c:1353)
8   js 	0x000581de js_InternalInvoke + 309 (jsinterp.c:1447)
9   js 	0x00083bf4 js_TryMethod + 346 (jsobj.c:4595)
10  js 	0x0008262a js_DefaultValue + 143 (jsobj.c:3886)
11  js 	0x000c49a4 js_ValueToString + 98 (jsstr.c:2656)
12  js 	0x00008ffb JS_ValueToString + 24 (jsapi.c:543)
13  js 	0x00002957 Process + 949 (js.c:270)
14  js 	0x000032b4 ProcessArgs + 1910 (js.c:494)
15  js 	0x00007e79 main + 612 (js.c:3159)
16  js 	0x00002446 _start + 216
17  js 	0x0000236d start + 41
Assignee: general → igor
This is another regression from bug 351102.
Depends on: 351102
Blocks: 351102
No longer depends on: 351102
Depends on: 374589
This is fixed as a part of the committed patch for bug 374589.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
/cvsroot/mozilla/js/tests/js1_7/decompilation/browser.js,v  <--  browser.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_7/decompilation/shell.js,v  <--  shell.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_7/decompilation/regress-374713.js,v  <--  regress-374713.js
initial revision: 1.1
Flags: in-testsuite+
verified fixed linux, windows, mac* shell 20070406
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.