Closed
Bug 461235
Opened 17 years ago
Closed 17 years ago
"Assertion failure: pos == GET_UINT16(pc)" decompiling function with array comprehension
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla1.9.1b2
People
(Reporter: jruderman, Assigned: brendan)
Details
(Keywords: assertion, regression)
Attachments
(1 file)
|
1.12 KB,
patch
|
mrbkap
:
review+
|
Details | Diff | Splinter Review |
js> print(function() { [1 for (b in [])]; var c; })
Assertion failure: pos == GET_UINT16(pc), at jsopcode.cpp:2905
This is a very recent regression and makes jsfunfuzz very unhappy.
|
Assignee | |
Updated•17 years ago
|
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b2
|
|
Assignee | |
Comment 1•17 years ago
|
||
Forgot about the vars/locals unification -- I'm old school, or my memory palace is decorated that way, I should say.
/be
Attachment #344385 -
Flags: review?(mrbkap)
|
||
Updated•17 years ago
|
Attachment #344385 -
Flags: review?(mrbkap) → review+
|
|
Assignee | |
Comment 2•17 years ago
|
||
Fixed, tm-only bug:
http://hg.mozilla.org/tracemonkey/rev/4df38d9ba4df
/be
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
|
||
Comment 3•17 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_7/regress/regress-461235.js,v <-- regress-461235.js
initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-
You need to log in
before you can comment on or make changes to this bug.
Description
•