./js js> this.__defineGetter__("x", "".match); if (x) 3; Assertion failure: *data->pc == JSOP_CALL || *data->pc == JSOP_NEW, at jsstr.cpp:1243 Affects both mozilla-central and tracemonkey branch, even without the "-j" option. mrbkap touched the code near this assertion recently, in bug 450529.
Created attachment 335803 [details] [diff] [review] Fix The code can't assume that we're on a call opcode as the testcase in this bug shows.
This affects 1.9.0.x branch too.
/cvsroot/mozilla/js/tests/js1_5/extensions/regress-452329.js,v <-- regress-452329.js initial revision: 1.1 http://hg.mozilla.org/mozilla-central/rev/576e250f78a4
Created attachment 352991 [details] [diff] [review] patch portage to 1.9.0.x This is a patch backport for the 1.9.0.x branch.
Comment on attachment 352991 [details] [diff] [review] patch portage to 1.9.0.x Approved for 220.127.116.11, a=dveditz for release-drivers.
Gary, were you going to check this in to the 1.9.0 branch?
(In reply to comment #8) > Gary, were you going to check this in to the 1.9.0 branch? Nope, I don't have checkin privs.
Checked into CVS for 18.104.22.168 Checking in js/src/jsstr.c; /cvsroot/mozilla/js/src/jsstr.c,v <-- jsstr.c new revision: 3.207; previous revision: 3.206 done
Bob, can you verify this for 22.214.171.124?
v 1.9.0, 1.9.1, 1.9.2