"Assertion failure: *data->pc == JSOP_CALL || *data->pc == JSOP_NEW"

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
9 years ago
9 years ago

People

(Reporter: Jesse Ruderman, Assigned: mrbkap)

Tracking

(Blocks: 1 bug, {assertion, testcase, verified1.9.0.6})

Trunk
x86
Mac OS X
assertion, testcase, verified1.9.0.6
Points:
---
Bug Flags:
wanted1.9.0.x +
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

9 years ago
./js
js> this.__defineGetter__("x", "".match); if (x) 3;

Assertion failure: *data->pc == JSOP_CALL || *data->pc == JSOP_NEW, at jsstr.cpp:1243

Affects both mozilla-central and tracemonkey branch, even without the "-j" option.  mrbkap touched the code near this assertion recently, in bug 450529.
(Assignee)

Comment 1

9 years ago
Created attachment 335803 [details] [diff] [review]
Fix

The code can't assume that we're on a call opcode as the testcase in this bug shows.
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #335803 - Flags: review?(brendan)
Attachment #335803 - Flags: review?(brendan) → review+
(Assignee)

Comment 2

9 years ago
http://hg.mozilla.org/tracemonkey/rev/a28e37f1058e
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
This affects 1.9.0.x branch too.
Flags: wanted1.9.0.x?
(Assignee)

Updated

9 years ago
Duplicate of this bug: 437081

Comment 5

9 years ago
/cvsroot/mozilla/js/tests/js1_5/extensions/regress-452329.js,v  <--  regress-452329.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/576e250f78a4
Flags: in-testsuite+
Flags: in-litmus-
Created attachment 352991 [details] [diff] [review]
patch portage to 1.9.0.x

This is a patch backport for the 1.9.0.x branch.
Attachment #352991 - Flags: review?(mrbkap)
Attachment #352991 - Flags: approval1.9.0.6?
(Assignee)

Updated

9 years ago
Attachment #352991 - Flags: review?(mrbkap) → review+
Flags: wanted1.9.0.x? → wanted1.9.0.x+
Comment on attachment 352991 [details] [diff] [review]
patch portage to 1.9.0.x

Approved for 1.9.0.6, a=dveditz for release-drivers.
Attachment #352991 - Flags: approval1.9.0.6? → approval1.9.0.6+
(Assignee)

Comment 8

9 years ago
Gary, were you going to check this in to the 1.9.0 branch?
(In reply to comment #8)
> Gary, were you going to check this in to the 1.9.0 branch?

Nope, I don't have checkin privs.

Comment 10

9 years ago
Checked into CVS for 1.9.0.6

Checking in js/src/jsstr.c;
/cvsroot/mozilla/js/src/jsstr.c,v  <--  jsstr.c
new revision: 3.207; previous revision: 3.206
done
Whiteboard: fixed1.9.0.6
Keywords: fixed1.9.0.6
Whiteboard: fixed1.9.0.6 → \
Whiteboard: \
Bob, can you verify this for 1.9.0.6?

Comment 12

9 years ago
v 1.9.0, 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.0.6 → verified1.9.0.6
You need to log in before you can comment on or make changes to this bug.