476086 - "Assertion failure: op == JSOP_GOTO || op == JSOP_GOTOX" with trap, array.some

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

function () {
    [].some([] ? null : null);
}
js> dis(f);
flags: LAMBDA INTERPRETED
main:
00000:  newarray 0
00004:  callprop "some"
00007:  newarray 0
00011:  ifeq 18 (7)
00014:  null
00015:  goto 19 (4)
00018:  null
00019:  call 1
00022:  pop
00023:  stop

Source notes:
  0:     4 [   4] pcbase   offset 4
  2:    11 [   7] cond     offset 4
  4:    19 [   8] xdelta  
  5:    19 [   0] pcbase   offset 19

js> f();
typein:1: TypeError: null is not a function
js> trap(f, 15, '');
js> f();
Assertion failure: op == JSOP_GOTO || op == JSOP_GOTOX, at ../jsopcode.cpp:5221

The assertion happens under js_ReportIsNotFunction.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

f = function () {
    [].some([] ? null : null);
}
f();
trap(f, 15, '');
f();


Seems to WFM in TM tip (but still crashes 1.9.0.x opt and asserts 1.9.0.x debug at Assertion failure: !JSVAL_IS_PRIMITIVE(regs.sp[i]), at jsinterp.c:3151 )

I'm guessing this is fixed by bug 463239.

Comment 2

[Jason Orendorff [:jorendorff]]

See bug 476079 comment 3 and 4 about writing test cases for trap().

Comment 3

[Bob Clary [:bc] (inactive)]

test dependent on bug 396512 (dis() should return disassembly))