uneval(Function(" = (*::*++);print(x);")); asserts js debug shell on JM changeset 7f471e15146e without any CLI arguments at Assertion failure: ss->top >= 2, does not seem to assert on MC changeset da362a07a5ee
There was a case where element inc/dec ops could be emitted for XML names, and the emitted bytecode was malformed. Pretty sure this code wasn't covered by any tests. http://hg.mozilla.org/projects/jaegermonkey/rev/ed0911cf98f2
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/e4x/bug672153.js.
You need to log in before you can comment on or make changes to this bug.