Closed Bug 461235 Opened 17 years ago Closed 17 years ago

"Assertion failure: pos == GET_UINT16(pc)" decompiling function with array comprehension

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla1.9.1b2

People

(Reporter: jruderman, Assigned: brendan)

Details

(Keywords: assertion, regression)

Attachments

(1 file)

js> print(function() { [1 for (b in [])]; var c; }) Assertion failure: pos == GET_UINT16(pc), at jsopcode.cpp:2905 This is a very recent regression and makes jsfunfuzz very unhappy.
Assignee: general → brendan
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b2
Forgot about the vars/locals unification -- I'm old school, or my memory palace is decorated that way, I should say. /be
Attachment #344385 - Flags: review?(mrbkap)
Attachment #344385 - Flags: review?(mrbkap) → review+
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07 /cvsroot/mozilla/js/tests/js1_7/regress/regress-461235.js,v <-- regress-461235.js initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: