Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Description • 14 years ago

function se()
eo = "fn"
function ha() function () {
    for each(af in a) {}
}
function rt() {
    if (sl) {}
}
function f1(code) {
    var f = eval("(function(){" + code + "})");
    f2(f, code, true)
    try {
        vv = f()
    } catch (or) {}
}
function f2(f, code, t) {
    f3(f, code, t)
}
function cg() {}
function f3(f, wtt) {
    var f, ug = uneval(f)
    if (wtt.eg) {}
}
function he(ce) io(oe, gs)
function ly(tt) {
    if (dg("ee") - 1) for (; il.th;) {}
}
function st() {
    if ("tp" in is) {
        if (wt) {
            if (de) {}
        }
    }
}
function ts(ft) {
    if (0 && ne == NK) {
        if (nt) {}
    }
}
__defineGetter__("x", gc)
f1("\
  for each(c in[\
    x,null,'',null,null,f,\"\",null,null,x,f,false,false,null,null,\"\",'',\"\",'','',null,x\
  ]){}\
")

asserts js debug shell on JM changeset 7c6f62fcbd91 with -m at Assertion failure: isRope(), at ../jsstr.h:371

	Andrew Drake [:adrake]
	Comment 1 • 14 years ago

Works for me on moo tip 64-bit, but fails on 32-bit.

	Sean Stangl [:sstangl]
	Comment 2 • 14 years ago

Note that 64-bit currently implies --disable-monoic, --disable-polyic.

	Andrew Drake [:adrake]
	Comment 3 • 14 years ago

Also fails when ICs are disabled.

	Andrew Drake [:adrake]
	Comment 4 • 14 years ago

Now fails only on 32bit, with assertion:

Assertion failure: !IsMarkedGCThing(cursor), at /home/adrake/src/moo/js/src/jsgc.cpp:1231

	Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) Reporter
	Comment 5 • 14 years ago

Confirming comment #4.

Here's another testcase that asserts at Assertion failure: !IsMarkedGCThing(cursor), at ../jsgc.cpp:1208 in 32-bit Linux shell with -m when passed in as a CLI argument:


function g(foo) {
    foo.replace("")
    f = Function(foo)
    f2(f, foo, f)
    f3(f, foo)
}
function f3() {
    try {
        v = f()
    } catch (o) {
        var r = (o)
    }
}
function f2() {
    f4(f)
}
function f4(f, e, t) {
    var g, uf, u
    uf = uneval(f)
    f5(uf)
}
function f5()
__defineGetter__("x", gc)
g("for(let z in[x,0,0,0,0,0,0,x]){}")

	David Anderson [:dvander] - inactive, e-mail if emergency
	Comment 6 • 14 years ago

This was fixed by bug 583084.