Closed Bug 472703 Opened 16 years ago Closed 16 years ago

TM: "Assertion failure: regs.sp[-1] == OBJECT_TO_JSVAL(fp->scopeChain), at ../jsinterp.cpp:2932"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, testcase, verified1.9.1)

for (var z = 0; z < 2; ++z) { with({}) for(let y in [1, null]); let(x) (function(){})(); } asserts dbg at Assertion failure: regs.sp[-1] == OBJECT_TO_JSVAL(fp->scopeChain), at ../jsinterp.cpp:2932 but seems harmless in opt. TM-only.
Flags: wanted1.9.1?
OS: Linux → All
Hardware: x86 → All
Setting to block bug 452498 because it involves scopeChain in the assertion message.
Depends on: upvar2
(In reply to comment #1) > Setting to block bug 452498 because it involves scopeChain in the assertion > message. ... and (important) it involves a function expression. /be
autoBisect shows this was fixed by http://hg.mozilla.org/tracemonkey/rev/74416c7004c5 : changeset: 26137:74416c7004c5 user: Jim Blandy date: Mon Mar 16 09:55:06 2009 -0700 summary: Bug 480132: Clone lexical blocks only when needed. r=igor
Status: NEW → RESOLVED
Closed: 16 years ago
Depends on: 480132
Flags: wanted1.9.1?
Resolution: --- → FIXED
http://hg.mozilla.org/tracemonkey/rev/5166e6465672 /cvsroot/mozilla/js/tests/js1_8/regress/regress-472703.js,v <-- regress-472703.js initial revision: 1.1
Flags: in-testsuite+
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: verified1.9.1
You need to log in before you can comment on or make changes to this bug.