TI: "Assertion failure: ss->top >= 2,"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
Windows 7
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

7 years ago
uneval(Function("[] = (*::*++);print(x);"));

asserts js debug shell on JM changeset 7f471e15146e without any CLI arguments at Assertion failure: ss->top >= 2, does not seem to assert on MC changeset da362a07a5ee
There was a case where element inc/dec ops could be emitted for XML names, and the emitted bytecode was malformed.  Pretty sure this code wasn't covered by any tests.

http://hg.mozilla.org/projects/jaegermonkey/rev/ed0911cf98f2
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Blocks: 647624
A testcase for this bug was automatically identified at js/src/jit-test/tests/e4x/bug672153.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.