767679 - IonMonkey: "Assertion failure: isObject(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

eval("\
    \"use strict\";\
    a();\
    function a() {\
        print\
    }\
")

asserts js debug shell on IonMonkey changeset 05a756967f25 with --ion-eager at Assertion failure: isObject(), 

Due to skipped revisions, the first bad revision could be any of:
changeset:   87140:f46cfb199e77
user:        Sean Stangl
date:        Mon Feb 06 17:15:24 2012 -0800
summary:     Make native calls faster. (Bug 721031, r=dvander)

changeset:   87141:2ce3daef5bd2
user:        Sean Stangl
date:        Mon Feb 06 17:55:48 2012 -0800
summary:     Fix warnings. (Bug 721031, red)

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

This is fixed with the most recent mozilla-central merge.

Comment 3

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397