js1_5/extensions/regress-424942.js - Assertion failure: (int16) JSVAL_TO_INT(id) == JSVAL_TO_INT(id)

VERIFIED FIXED in mozilla1.9.1

Status

()

P1
normal
VERIFIED FIXED
10 years ago
10 years ago

People

(Reporter: bc, Assigned: brendan)

Tracking

(4 keywords)

Trunk
mozilla1.9.1
assertion, regression, testcase, verified1.9.1
Points:
---
Bug Flags:
blocking1.9.1 -
wanted1.9.1 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

10 years ago
js1_5/extensions/regress-424942.js shell linux so far.

Assertion failure: (int16) JSVAL_TO_INT(id) == JSVAL_TO_INT(id), at ../jsfun.cpp:1071
Flags: in-testsuite+
(Reporter)

Comment 1

10 years ago
oops. tracemonkey.
(Reporter)

Comment 2

10 years ago
http://hg.mozilla.org/tracemonkey/rev/f08193a65af1
bug 496790 did this.
Blocks: 496790
(Reporter)

Updated

10 years ago
OS: Linux → All
(Reporter)

Updated

10 years ago
Flags: blocking1.9.1?

Updated

10 years ago
Flags: blocking1.9.1? → blocking1.9.1+
(Assignee)

Updated

10 years ago
Assignee: general → brendan
Status: NEW → ASSIGNED
Priority: -- → P1
Hardware: x86 → All
Target Milestone: --- → mozilla1.9.1
(Assignee)

Comment 3

10 years ago
Created attachment 382552 [details] [diff] [review]
fix the assertbotch

This is a debug-only assertion botch, the non-DEBUG code does the right thing.

/be
Attachment #382552 - Flags: review?(igor)
(Assignee)

Comment 4

10 years ago
http://hg.mozilla.org/tracemonkey/rev/61ac579284a2

/be
Whiteboard: fixed-in-tracemonkey
Debug-only assertion is not a blocker, but is still welcome.
Flags: wanted1.9.1+
Flags: blocking1.9.1-
Flags: blocking1.9.1+

Comment 6

10 years ago
http://hg.mozilla.org/mozilla-central/rev/61ac579284a2
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED

Updated

10 years ago
Attachment #382552 - Flags: review?(igor) → review+

Comment 7

10 years ago
Comment on attachment 382552 [details] [diff] [review]
fix the assertbotch

>diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
>@@ -1207,7 +1207,7 @@ call_resolve(JSContext *cx, JSObject *ob
>+            if (!CallPropertyOp(cx, obj, INT_TO_JSID((int16)slot), &v, JSCPK_VAR, JS_FALSE))

Nit: use int16(slot).
(Assignee)

Comment 8

10 years ago
Nearby cast used C style, of course (since the code was written in 1.9 era) and the assertion does too. I'll clean up on trunk in another bug, opportunistically. Thanks,

/be
(Reporter)

Comment 10

10 years ago
v 1.9.1, 1.9.2 on mac intel.
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.