Closed
Bug 906242
Opened 11 years ago
Closed 11 years ago
GenerationalGC: Crash [@ js::ion::GetPropertyIC::UpdateInfo]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 906236
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, regression, testcase)
Crash Data
Attachments
(1 file)
1.76 KB,
text/plain
|
Details |
try { (2, {}) } catch (e) {} try { (function() { Object.defineProperty(this, "v1", { get: function() { Object.e({ l: false, o: true, l: (Object(({ s: ((function f(vsollj) { print f(vsollj) const d = eval(""), w = (((""))) })(2)) }))), n: e, n: f }) } }) }) () (v1) (function() { ({}) }) } catch (e) {} crashes js debug shell (tested with a threadsafe 64-bit debug build) on m-i changeset a63f47fcbe98 without any CLI arguments at js::ion::GetPropertyIC::UpdateInfo autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 140539:1a0e01422cb3 user: Terrence Cole date: Wed Jul 10 10:13:46 2013 -0700 summary: Bug 889682 - Eagerly check for remembered set membership before buffering; r=billm
Flags: needinfo?(terrence)
Comment 1•11 years ago
|
||
This is the same issue as bug 906236. I've verified that the patch posted there fixes this issue too.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: needinfo?(terrence)
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•