496870 - "Assertion failure: op == JSOP_ADD, at ../jsopcode.cpp"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

"" + new Function("<x{[]%\"\"}/>");

asserts TM debug js shell without -j at Assertion failure: op == JSOP_ADD, at ../jsopcode.cpp:2102

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This seems ancient.

The testcase asserts in 01012006 CVS checkout but not in 01012003 CVS checkout.

This is in no way blocking1.9.1 since it's been present for so long but as per previous experience, will be good to first have some opinion as to the severity of this bug, just-in-case.

Comment 2

[Jesse Ruderman]

Slightly cleaner testcase:

"" + (function(){ <x{y*0}/> })

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: I feel dirty

The fuzzer owes me a beer for fixing an E4X bug. Or Gary, either one. :)

Comment 4

[Brendan Eich [:brendan]]

Blake, this had your name all over it :-P.

/be

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

An additional testcase that misbehaved:

  function() <x{y+0}/>

was returning

  function() <x{y0}/>

due to the same problem.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/f50409fe63ed

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/f50409fe63ed

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The patch applies as-is on the 1.9.1 branch. Should it land on 1.9.1?

Comment 9

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/62dae27ab113

Comment 10

[Mike Beltzner [:beltzner, not reading bugmail]]

Mass change: adding fixed1.9.2 keyword

(This bug was identified as a mozilla1.9.2 blocker which was fixed before the mozilla-1.9.2 repository was branched (August 13th, 2009) as per this query: http://is.gd/2ydcb - if this bug is not actually fixed on mozilla1.9.2, please remove the keyword. Apologies for the bugspam)

Comment 11

[Christian Holler (:decoder)]

E4X has been removed, so we won't add the test.