Last Comment Bug 657979 - TI: "Assertion failure: op == JSOP_NEWARRAY || op == JSOP_NEWOBJECT || op == JSOP_NEWINIT," with trap
: TI: "Assertion failure: op == JSOP_NEWARRAY || op == JSOP_NEWOBJECT || op == ...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on:
Blocks: jsfunfuzz infer-regress
  Show dependency tree / graph
 
Reported: 2011-05-18 10:53 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2011-05-19 16:24 PDT (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Attachments
dis() information, and stack (3.71 KB, text/plain)
2011-05-18 10:53 PDT, Gary Kwong [:gkw] [:nth10sd] 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Description Gary Kwong [:gkw] [:nth10sd] 2011-05-18 10:53:55 PDT 
Created attachment 533325 [details]
dis() information, and stack

function f(){ with({a:0}){}; }
dis(f)
trap(f, 0, '')
f()

asserts js debug shell on JM changeset 5d1cbc94bc42 with -d, -a and -n at Assertion failure: op == JSOP_NEWARRAY || op == JSOP_NEWOBJECT || op == JSOP_NEWINIT,
Comment 1 Brian Hackett (:bhackett) 2011-05-19 16:24:08 PDT 
Fixed as part of bug 657975.

http://hg.mozilla.org/projects/jaegermonkey/rev/176ee6b37ad0
Note You need to log in before you can comment on or make changes to this bug.