426827 - "Assertion failure: !(js_CodeSpec[op2].format & JOF_DEL), at jsinterp.c" or "Assertion failure: !(js_CodeSpec[op2].format & JOF_DEL), at ../jsinterp.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan Darmochwal]

js> eval()=delete a;

Assertion failure: !(js_CodeSpec[op2].format & JOF_DEL), at jsinterp.c:4878

expected: SyntaxError: invalid assignment left-hand side

Comment 1

[Brian Crowder]

This does yield an invalid assignment error in OPT.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: backtrace, full

Still occurs with TM tip and 1.9.0.x branch.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This should be a regression of bug 423300.

Seems to work as expected with cvs js shell checkout at 2008-03-18 18:37 PDT
Asserts with cvs js shell checkout at 2008-03-18 18:39 PDT

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2008-03-18+18%3A37%3A00&maxdate=2008-03-18+18%3A39%3A00&cvsroot=%2Fcvsroot

Bonsai message:

Fix JSOP_SETCALL to cope with delete f() and the like (423300, r=mrbkap, a=beltzner).

Comment 4

[Igor Bukanov]

The bug is not crytical - when the assert is violated in an optimized build, the interpreter throws an exception as it would do when the same code path would be hit with the assertion condition held.

Comment 5

[Igor Bukanov]

Attachment: fix v1

The fix just removes the assert. An alternative is to replace it with one that requires the absence of JOF_DEL only if opcode uses at least one stack operand, but then such assert would look rather arbitrary.

Comment 6

[Igor Bukanov]

landed to TM - http://hg.mozilla.org/tracemonkey/rev/9297d5d86348

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/a45eb680c66c

Comment 8

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/2692c05bbec4

Comment 9

[Bob Clary [:bc] (inactive)]

js1_5/Regress/regress-426827.js	
http://hg.mozilla.org/tracemonkey/rev/f793d2d8a984

Comment 10

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2

Comment 11

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-426827.js,v  <--  regress-426827.js
initial revision: 1.1