595911 - TM: "Assertion failure: INT_FITS_IN_JSID(i),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

[(delete(/x/ [x])) for each(x in [0, 0, 0, 0, 0, x, 0, 0, 0x40000001])]

asserts js debug shell on TM changeset f5e128da7b5f with -j at Assertion failure: INT_FITS_IN_JSID(i),

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   42772:fc98415b2fad
user:        Brendan Eich
date:        Tue Jun 01 19:42:37 2010 -0700
summary:     Trace JSOP_DEL{PROP,ELEM} (523452, r=gal).

Comment 2

[Jeff Walden [:Waldo]]

Attachment: Don't assume 32-bit integer implies INT_FITS_IN_JSID

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 484207 [details] [diff] [review]
Don't assume 32-bit integer implies INT_FITS_IN_JSID

Thanks, r=me.

/be

Comment 4

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/70caa8e863bc

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/70caa8e863bc

Comment 6

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929