482421 - TM: "Assertion failure: vp >= StackBase(fp), at ../jsinterp.cpp"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f()
{
  var x;
  var foo = "for (var z = 0; z < 2; ++z) { new Object(new String(this), x)}";
  foo.replace(/\n/g, " ");
  eval(foo);
}
f();

asserts at Assertion failure: vp >= StackBase(fp), at ../jsinterp.cpp:4764 in debug TM js shell with -j only. (Opt seems to work as expected, with and without -j)

This should be a regression _caused by_ bug 482349.

The first bad revision is:
changeset:   25784:b8f929cd479d
parent:      25781:5374efa7d144
user:        Andreas Gal
date:        Mon Mar 09 17:29:42 2009 -0700
summary:     Support String(v) -- String constructor called as a converter (482349, r=jwalden).

Thanks to Waldo for helping me with this on IRC.

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Sigh. Have to systematize the callable constructors after this spot-fix.

/be

Comment 2

[Andreas Gal :gal]

Comment on attachment 366526 [details] [diff] [review]
fix

oops. my bad.

Comment 3

[Brendan Eich [:brendan]]

Fixed in tm:

http://hg.mozilla.org/tracemonkey/rev/efc628a65166

Closing since it didn't yet appear in m-c.

/be

Comment 4

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/efc628a65166

Comment 5

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/tracemonkey/rev/d26e590802be
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-482421.js,v  <--  regress-482421.js
initial revision: 1.1

Comment 6

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/1118dc69dca6

Comment 7

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2