Closed
Bug 668479
Opened 13 years ago
Closed 13 years ago
TM: Assertion failure: fp->hasCallObj(), at jsfun.cpp:248
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla8
People
(Reporter: decoder, Assigned: luke)
Details
(Keywords: assertion, testcase, Whiteboard: [inbound])
Attachments
(1 file)
|
1.37 KB,
patch
|
Waldo
:
review+
|
Details | Diff | Splinter Review |
The following test asserts on TM revision c2e5e424e6c3 (run with options -j -m):
function a() {
with(a) eval("arguments[0]");
} a();
This could be related to 643543 (which is not only in TI) but according to the tests I assume that this is a different defect.
|
Assignee | |
Comment 1•13 years ago
|
||
This assert is from back before bug 539144 back when hasArgsObj was true for eval frames (now its only true for the frame that owns the args obj). This patch updates the assert and the comment.
|
|
Assignee | |
Updated•13 years ago
|
Attachment #543164 -
Flags: review? → review?(jwalden+bmo)
|
||
Comment 2•13 years ago
|
||
Comment on attachment 543164 [details] [diff] [review] fix old assert One from the vaults!
Attachment #543164 -
Flags: review?(jwalden+bmo) → review+
|
|
Assignee | |
Comment 3•13 years ago
|
||
http://hg.mozilla.org/integration/mozilla-inbound/rev/f317927aafcb
Whiteboard: [inbound]
|
||
Comment 4•13 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/f317927aafcb
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla8
|
Reporter | |
Comment 5•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug668479.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•