601400 - JM: "Assertion failure: offset < script->length,"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

eval("\
    function NaN() {}\
    for(w in s) {}\
")

asserts js debug shell on TM changeset 0230a9e80c1f with -m at Assertion failure: offset < script->length,

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This seems to have occurred since the advent of JM although I'm really not sure..

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

bogus assert, you can throw inside script->main

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/9156ba8a843d

Comment 4

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/9156ba8a843d

Comment 5

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug601400.js.