Closed Bug 396326 Opened 12 years ago Closed 12 years ago

Assertion failure trying to disassemble get(var|arg)prop

Categories

(Core :: JavaScript Engine, defect, minor)

defect
Not set
minor

Tracking

()

VERIFIED FIXED

People

(Reporter: Seno.Aiko, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(1 file)

Debug shell-only problem:

Trying to disassemble a function containing var.prop or arg.prop results in assertion failure: (script)->objectsOffset != 0, at jsopcode.c:356. getlocalprop doesn't assert but the output is incorrect; getthisprop works.

Testcases:
function f1() { var v; return v.prop } ; dis(f1)
function f2(arg) { return arg.prop } ; dis(f2)
function f3() { return this.prop } ; dis(f3)
function f4() { let local; return local.prop } ; dis(f4)
Attachment #281065 - Flags: review?(mrbkap)
Comment on attachment 281065 [details] [diff] [review]
fix wrong JOF_ type check

Good catch!
Attachment #281065 - Flags: review?(mrbkap) → review+
I'll approve. Igor or Blake will have to check in.

/be
Attachment #281065 - Flags: approval1.9+
I checked in the patch from comment 0 to the trunk:

Checking in jsopcode.c;
/cvsroot/mozilla/js/src/jsopcode.c,v  <--  jsopcode.c
new revision: 3.265; previous revision: 3.264
done

Indeed thanks for catching this!
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Note that Bug 387994 is still reproducible.
Blocks: 385729
Keywords: regression, testcase
/cvsroot/mozilla/js/tests/js1_5/extensions/regress-396326.js,v  <--  initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_7/extensions/regress-396326.js,v  <--  initial revision: 1.1
Flags: in-testsuite+
verified fixed 1.9.0 linux/mac*/windows
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.