Closed
Bug 658464
Opened 13 years ago
Closed 13 years ago
TI: "Assertion failure: op != JSOP_TRAP,", with trap
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, testcase)
function f() { for ([, x] in 0) {} } dis(f) trap(f, 9, '') f() asserts js debug shell on JM changeset aec367836312 with -m, -d, -a and -n at Assertion failure: op != JSOP_TRAP, flags: NULL_CLOSURE off op ----- -- main: 00000: zero 00001: iter 1 00003: goto 29 (26) 00006: trace 0 00009: forelem <-- trap goes here 00010: dup 00011: zero 00012: getelem 00015: pop 00016: dup 00017: one 00018: getelem 00021: bindname "x" 00024: qnamepart "x" 00027: enumelem 00028: pop 00029: moreiter 00030: ifne 6 (-24) 00033: enditer 00034: stop Source notes: ofs line pc delta desc args ---- ---- ----- ------ -------- ------ 0: 1 0 [ 0] newline 1: 2 3 [ 3] if-else else 26 elseif 27 4: 2 6 [ 3] while offset 24 6: 2 10 [ 4] decl offset 3 8: 2 16 [ 6] continue 9: 2 27 [ 11] xdelta 10: 2 27 [ 0] pcbase offset 6 Exception table: kind stack start end iter 1 6 33
Comment 1•13 years ago
|
||
Forgot to update the loop analysis to handle traps, we just shouldn't be doing any loop analysis in debug mode compartments and scripts. http://hg.mozilla.org/projects/jaegermonkey/rev/07412de099f6
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•