Closed
Bug 462879
Opened 17 years ago
Closed 17 years ago
"Assertion failure: UPVAR_FRAME_SKIP(uva->vector[i]) == 1" with nested eval
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla1.9.1b2
People
(Reporter: jruderman, Assigned: brendan)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
910 bytes,
patch
|
mrbkap
:
review+
|
Details | Diff | Splinter Review |
(function(c){eval("eval('c.x')")})()
Assertion failure: UPVAR_FRAME_SKIP(uva->vector[i]) == 1, at jsopcode.cpp:2756
Tracemonkey branch, JIT does not have to be enabled.
Regression from bug 456692 or bug 461801, maybe?
|
Assignee | |
Comment 1•17 years ago
|
||
Bogus assertion left in wake of bug 456692, sorry about that. Patch anon.
/be
|
|
Assignee | |
Updated•17 years ago
|
Assignee: general → brendan
Blocks: 456692
Status: NEW → ASSIGNED
OS: Mac OS X → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9.1b2
|
|
Assignee | |
Comment 2•17 years ago
|
||
I don't think it's worth trying to assert anything about the frame-skip half of the upvar cookie. Tell me if you disagree.
/be
Attachment #346082 -
Flags: review?(mrbkap)
|
||
Updated•17 years ago
|
Attachment #346082 -
Flags: review?(mrbkap) → review+
|
|
||
Comment 3•17 years ago
|
||
Comment on attachment 346082 [details] [diff] [review]
fix
All you'd be doing would be repeating the code in js_EmitTree, so I don't think it's worth it.
|
|
Assignee | |
Comment 4•17 years ago
|
||
Fixed on tm:
http://hg.mozilla.org/tracemonkey/rev/63c321968e70
/be
|
||
Updated•17 years ago
|
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
|
||
Comment 5•17 years ago
|
||
test landed http://hg.mozilla.org/mozilla-central/rev/6d5b8d6012f3 and cvs
Flags: in-testsuite+
Flags: in-litmus-
You need to log in
before you can comment on or make changes to this bug.
Description
•