Closed Bug 432089 Opened 16 years ago Closed 16 years ago

"Assertion failure: (uintN)(pcdepth + ndefs) <= script->depth" with trap, dvg

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: assertion, testcase) 

var i;
var f;
var bangs = "";
for (i = 0; i < 100; ++i)
{
  bangs += "!";
  f = new Function("a", bangs + "a; a ? 1 : {}; (1 for (x in []))();");
  trap(f, 0, "");
  "" + f;
  try { f(true); } catch(e) { print(i + " " + e); }
}


Expected: "TypeError: (1 for (x in [])) is not a function" on all 100 lines of output

Result in opt: "TypeError: ({}) is not a function", starting at line 68 of output

Result in debug: 
Assertion failure: (uintN)(pcdepth + ndefs) <= script->depth, at jsopcode.c:5182
Igor's patch from bug 430293 comment #8 fixes this.
Depends on: 430293
WFM
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.