396326 - Assertion failure trying to disassemble get(var|arg)prop

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Aiko]

Attachment: fix wrong JOF_ type check

Debug shell-only problem:

Trying to disassemble a function containing var.prop or arg.prop results in assertion failure: (script)->objectsOffset != 0, at jsopcode.c:356. getlocalprop doesn't assert but the output is incorrect; getthisprop works.

Testcases:
function f1() { var v; return v.prop } ; dis(f1)
function f2(arg) { return arg.prop } ; dis(f2)
function f3() { return this.prop } ; dis(f3)
function f4() { let local; return local.prop } ; dis(f4)

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 281065 [details] [diff] [review]
fix wrong JOF_ type check

Good catch!

Comment 2

[Brendan Eich [:brendan]]

I'll approve. Igor or Blake will have to check in.

/be

Comment 3

[Igor Bukanov]

I checked in the patch from comment 0 to the trunk:

Checking in jsopcode.c;
/cvsroot/mozilla/js/src/jsopcode.c,v  <--  jsopcode.c
new revision: 3.265; previous revision: 3.264
done

Indeed thanks for catching this!

Comment 4

[Bob Clary [:bc] (inactive)]

Note that Bug 387994 is still reproducible.

Comment 5

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/extensions/regress-396326.js,v  <--  initial revision: 1.1

/cvsroot/mozilla/js/tests/js1_7/extensions/regress-396326.js,v  <--  initial revision: 1.1

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.9.0 linux/mac*/windows