Closed Bug 844459 Opened 11 years ago Closed 10 years ago

IonMonkey: Assertion failure: thisValue.isObject() || thisValue.isUndefined() || thisValue.isNull(), at builtin/Eval.cpp:367

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox33 --- fixed
firefox34 --- fixed
firefox35 --- fixed
firefox36 --- fixed
firefox-esr31 --- fixed

People

(Reporter: decoder, Unassigned)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update]) 

The following testcase asserts on mozilla-central revision e162098b76d9 (run with --ion-eager):


function testEvalThrow(x, y) {
  eval("");
}
for (var i = 0; i < 5; i++)
  testEvalThrow.call("");
A fix for this seems to be in bug 844364.
Whiteboard: [jsbugmon:update,bisect,bisectfix]
Whiteboard: [jsbugmon:update,bisect,bisectfix] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 47876c1d1c45).
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122539:dc30947a2d26
user:        Brian Hackett
date:        Thu Feb 21 05:38:44 2013 -0700
summary:     Bug 842305 - Watch for null payloads flowing into Ion, r=jandem.

This iteration took 110.307 seconds to run.

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   122946:0f9bcf85f0b7
user:        Brian Hackett
date:        Mon Feb 25 15:17:12 2013 -0700
summary:     Bug 844364 - Fix bogus assertion, inverted test when compiling JSOP_EVAL, r=jandem.

This iteration took 120.604 seconds to run.
Assignee: general → nobody
The testcases in this bug and bug 844364 both involve eval, so I guess in addition to comment 2 it's safe to say it's fixed by bug 844364 as well.
Status: NEW → RESOLVED
Closed: 10 years ago
status-firefox33: --- → fixed
status-firefox34: --- → fixed
status-firefox35: --- → fixed
status-firefox36: --- → fixed
status-firefox-esr31: --- → fixed
Flags: in-testsuite?
Keywords: regression
Resolution: --- → FIXED
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update]
You need to log in before you can comment on or make changes to this bug.