Closed
Bug 379925
Opened 18 years ago
Closed 18 years ago
"Assertion failure: pc[oplen] == JSOP_POP || pc[oplen] == JSOP_SETSP"
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
mozilla1.9alpha5
People
(Reporter: jruderman, Assigned: brendan)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(1 file)
|
6.44 KB,
patch
|
igor
:
review+
|
Details | Diff | Splinter Review |
js> function() { for(var [x, x] = [,,] in []); }
Assertion failure: pc[oplen] == JSOP_POP || pc[oplen] == JSOP_SETSP, at jsopcode.c:1297
|
Assignee | |
Comment 1•18 years ago
|
||
How did I miss those JSOP_SETSP assertions and tests in jsopcode.c?
This also simplifies the emitter by removing the wantpop optimization, allowing the decompiler to interpret JSOP_POPN in a context-free way when decompiling group assignment. Always emitting JSOP_POP after JSOP_SETLOCAL, etc., also paves the way for future fixing of bug 312354.
/be
|
|
Assignee | |
Updated•18 years ago
|
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9alpha5
|
||
Updated•18 years ago
|
Attachment #264065 -
Flags: review?(igor) → review+
|
|
Assignee | |
Comment 2•18 years ago
|
||
Fixed on trunk:
js/src/jsemit.c 3.249
js/src/jsopcode.c 3.234
/be
Status: ASSIGNED → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
|
||
Comment 3•18 years ago
|
||
/cvsroot/mozilla/js/tests/js1_7/decompilation/regress-379925.js,v <-- regress-379925.js
initial revision: 1.1
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•