Closed Bug 496870 Opened 13 years ago Closed 13 years ago

"Assertion failure: op == JSOP_ADD, at ../jsopcode.cpp"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
status1.9.2 --- beta1-fixed

People

(Reporter: gkw, Assigned: mrbkap)

Details

(4 keywords, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

"" + new Function("<x{[]%\"\"}/>");

asserts TM debug js shell without -j at Assertion failure: op == JSOP_ADD, at ../jsopcode.cpp:2102
This seems ancient.

The testcase asserts in 01012006 CVS checkout but not in 01012003 CVS checkout.

This is in no way blocking1.9.1 since it's been present for so long but as per previous experience, will be good to first have some opinion as to the severity of this bug, just-in-case.
Slightly cleaner testcase:

"" + (function(){ <x{y*0}/> })
Flags: blocking1.9.2?
Attached patch I feel dirtySplinter Review
The fuzzer owes me a beer for fixing an E4X bug. Or Gary, either one. :)
Assignee: general → mrbkap
Status: NEW → ASSIGNED
Attachment #382190 - Flags: review?(jwalden+bmo)
Attachment #382190 - Flags: review?(jwalden+bmo) → review+
Blake, this had your name all over it :-P.

/be
An additional testcase that misbehaved:

  function() <x{y+0}/>

was returning

  function() <x{y0}/>

due to the same problem.
http://hg.mozilla.org/mozilla-central/rev/f50409fe63ed
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Flags: blocking1.9.2? → blocking1.9.2+
Resolution: --- → FIXED
The patch applies as-is on the 1.9.1 branch. Should it land on 1.9.1?
Flags: wanted1.9.1?
Flags: wanted1.9.1? → wanted1.9.1+
Flags: in-testsuite?
Mass change: adding fixed1.9.2 keyword

(This bug was identified as a mozilla1.9.2 blocker which was fixed before the mozilla-1.9.2 repository was branched (August 13th, 2009) as per this query: http://is.gd/2ydcb - if this bug is not actually fixed on mozilla1.9.2, please remove the keyword. Apologies for the bugspam)
Keywords: fixed1.9.2
E4X has been removed, so we won't add the test.
Flags: in-testsuite? → in-testsuite-
You need to log in before you can comment on or make changes to this bug.