Closed Bug 843856 Opened 11 years ago Closed 11 years ago

BaselineCompiler: Assertion failure: false (Unexpected state), at vm/Stack.cpp:1867

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,reconfirm,ignore]) 

The following testcase asserts on baseline compiler branch revision de894e57ecb2 (run with --ion-eager):


eval("\
var z = 0;\
function f() {\
    if (z++ > 8)\
        myfunc1.toString() , counter < 5;\
}\
try {\
    for (var i = 0; i < 10; i++)\
        new f();\
} catch(e)  {  }\
");
Whiteboard: [jsbugmon:update] → [jsbugmon:update,reconfirm]
Whiteboard: [jsbugmon:update,reconfirm] → [jsbugmon:update,reconfirm,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 36b6a36c00bc).
Bug 743394 changed how evalPrev works and also fixed this bug.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.