"Assertion failure: pos == GET_UINT16(pc)" decompiling function with array comprehension

RESOLVED FIXED in mozilla1.9.1b2

Status

()

Product:
Core
Component:
JavaScript Engine
Type:
defect
Importance:
P1
critical
Status:
RESOLVED FIXED
Opened:
11 years ago
Updated:
11 years ago

People

(Reporter: jruderman, Assigned: brendan)

Tracking

(Blocks 1 bug, {assertion, regression})

Version:
Trunk
Target:
mozilla1.9.1b2
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

fix bogus assertion
1.12 KB, patch
mrbkap
: review+
Details | Diff | Splinter Review 
js> print(function() { [1 for (b in [])]; var c; }) 
Assertion failure: pos == GET_UINT16(pc), at jsopcode.cpp:2905

This is a very recent regression and makes jsfunfuzz very unhappy.
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b2
Forgot about the vars/locals unification -- I'm old school, or my memory palace is decorated that way, I should say.

/be
Attachment #344385 - Flags: review?(mrbkap)
Attachment #344385 - Flags: review?(mrbkap) → review+
Fixed, tm-only bug:

http://hg.mozilla.org/tracemonkey/rev/4df38d9ba4df

/be
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_7/regress/regress-461235.js,v  <--  regress-461235.js
initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.