Closed Bug 424311 Opened 16 years ago Closed 16 years ago

Assertion failure with "constructor=({});"

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Milestone:
mozilla1.9beta5

People

(Reporter: jruderman, Assigned: brendan)

References

Details

(Keywords: assertion, regression, testcase) 

js> (function(){(function(){ constructor=({}); })()})()
Assertion failure: entry->kpc == ((PCVCAP_TAG(entry->vcap) > 1) ? (jsbytecode *) JSID_TO_ATOM(id) : cx->fp->regs->pc), at jsobj.c:3477

jsfunfuzz hits this about once a minute :(

This is the same assertion failure as in bug 416834, but the testcases seem completely different, and I think this is a much more recent regression.
This could have been regressed by the patch for bug 418989, which was good by itself but exposed the latent bug, namely that the assertion is bogus. But there may be more to it than this. Jesse, can you track down the regression window?

/be
Assignee: general → brendan
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9beta5
Yes, this is a regression from bug 418989 (verified using checkout-by-date).

Is it bogus in bug 416834 too, or is something actually going wrong there?
Blocks: 418989
WFM on trunk.
Status: NEW → RESOLVED
Closed: 16 years ago
Flags: in-testsuite?
Resolution: --- → WORKSFORME
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-424311.js,v  <--  regress-424311.js
initial revision: 1.1
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.