This is a bug to capture the current Reg. Exp. bugs & proposed patch rather than having to update it in all the various locations.

Hmm, I reviewed the whole mega-meta-patch in bug 57572. /be

rval = POP_OPND(); if (JSVAL_IS_PRIMITIVE(rval)) { + str = js_DecompileValueGenerator(cx, -1, rval, NULL); Use 0, not -1, since you just popped rval (stack grows upward, pops downward, so it's now at sp[0], not sp[-1]). Wait, that won't work: 0 is JSDVG_IGNORE_STACK, only negative indexes cause js_DecompileValueGenerator to load an operand and its generating pc. Ok, do this: rval = FETCH_OPND(-1); if (JSVAL_IS_PRIMITIVE(rval)) { + str = js_DecompileValueGenerator(cx, -1, rval, NULL); + if (str) { JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, - JSMSG_IN_NOT_OBJECT); + JSMSG_IN_NOT_OBJECT, + JS_GetStringBytes(str)); + } ok = JS_FALSE; goto out; } + sp--; Note the sp--; after the error check. Fix this, and sr=brendan@mozilla.org. /be

And pls. test in the JS shell that the error report for an invalid 'in' operator is what you expect. Try all cases for the 'in' operator that make sense. Here is a template for 'instanceof' that covers the various decompiler cases: var o = {}, O = {P:1}; o instanceof 3; o instanceof O; o instanceof Object; o instanceof O.P; var id = 'P'; o instanceof O[id]; /be

Fix checked in.

Verified Fixed - ran this test suite directory on Linux, WinNT, and Mac js/tests/ecma_3/RegExp/ with both debug and optimized versions of the JS shell, and got 0 errors.