Bug 491806 - "Assertion failure: (uintN)i < ss->top, at ../jsopcode.cpp" with uneval, for, yield (r=mrbkap).
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -6055,28 +6055,37 @@ BumpStaticLevel(JSParseNode *pn, JSTreeC
if (pn->pn_cookie != FREE_UPVAR_COOKIE) {
uintN level = UPVAR_FRAME_SKIP(pn->pn_cookie) + 1;
JS_ASSERT(level >= tc->staticLevel);
pn->pn_cookie = MAKE_UPVAR_COOKIE(level, UPVAR_FRAME_SLOT(pn->pn_cookie));
}
}
+static void
+AdjustBlockId(JSParseNode *pn, uintN adjust, JSTreeContext *tc)
+{
+ JS_ASSERT(pn->pn_arity == PN_LIST || pn->pn_arity == PN_FUNC || pn->pn_arity == PN_NAME);
+ pn->pn_blockid += adjust;
+ if (pn->pn_blockid >= tc->blockidGen)
+ tc->blockidGen = pn->pn_blockid + 1;
+}
+
bool
CompExprTransplanter::transplant(JSParseNode *pn)
{
if (!pn)
return true;
switch (pn->pn_arity) {
case PN_LIST:
for (JSParseNode *pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next)
transplant(pn2);
if (pn->pn_pos >= root->pn_pos)
- pn->pn_blockid += adjust;
+ AdjustBlockId(pn, adjust, tc);
break;
case PN_TERNARY:
transplant(pn->pn_kid1);
transplant(pn->pn_kid2);
transplant(pn->pn_kid3);
break;
@@ -6142,17 +6151,17 @@ CompExprTransplanter::transplant(JSParse
* multiple times).
*
* Non-placeholder definitions within the comprehension expression
* will be visited further below.
*/
if (dn->isPlaceholder() && dn->pn_pos >= root->pn_pos && dn->dn_uses == pn) {
if (genexp)
BumpStaticLevel(dn, tc);
- dn->pn_blockid += adjust;
+ AdjustBlockId(dn, adjust, tc);
}
JSAtom *atom = pn->pn_atom;
#ifdef DEBUG
JSStmtInfo *stmt = js_LexicalLookup(tc, atom, NULL);
JS_ASSERT(!stmt || stmt != tc->topStmt);
#endif
if (genexp && PN_OP(dn) != JSOP_CALLEE) {
@@ -6191,17 +6200,17 @@ CompExprTransplanter::transplant(JSParse
}
ALE_SET_DEFN(ale, dn);
}
}
}
if (pn->pn_pos >= root->pn_pos)
- pn->pn_blockid += adjust;
+ AdjustBlockId(pn, adjust, tc);
break;
case PN_NAMESET:
transplant(pn->pn_tree);
break;
}
return true;
}