Closed
Bug 472703
Opened 16 years ago
Closed 16 years ago
TM: "Assertion failure: regs.sp[-1] == OBJECT_TO_JSVAL(fp->scopeChain), at ../jsinterp.cpp:2932"
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
VERIFIED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, testcase, verified1.9.1)
for (var z = 0; z < 2; ++z) { with({}) for(let y in [1, null]); let(x) (function(){})(); }
asserts dbg at Assertion failure: regs.sp[-1] == OBJECT_TO_JSVAL(fp->scopeChain), at ../jsinterp.cpp:2932 but seems harmless in opt. TM-only.
Flags: wanted1.9.1?
Reporter | ||
Updated•16 years ago
|
OS: Linux → All
Hardware: x86 → All
Reporter | ||
Comment 1•16 years ago
|
||
Setting to block bug 452498 because it involves scopeChain in the assertion message.
Depends on: upvar2
Comment 2•16 years ago
|
||
(In reply to comment #1)
> Setting to block bug 452498 because it involves scopeChain in the assertion
> message.
... and (important) it involves a function expression.
/be
Reporter | ||
Comment 3•16 years ago
|
||
autoBisect shows this was fixed by
http://hg.mozilla.org/tracemonkey/rev/74416c7004c5 :
changeset: 26137:74416c7004c5
user: Jim Blandy
date: Mon Mar 16 09:55:06 2009 -0700
summary: Bug 480132: Clone lexical blocks only when needed. r=igor
Status: NEW → RESOLVED
Closed: 16 years ago
Depends on: 480132
Flags: wanted1.9.1?
Resolution: --- → FIXED
Comment 4•16 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/5166e6465672
/cvsroot/mozilla/js/tests/js1_8/regress/regress-472703.js,v <-- regress-472703.js
initial revision: 1.1
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•