Closed
Bug 1073702
Opened 10 years ago
Closed 10 years ago
Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
FIXED
mozilla35
Tracking | Status | |
---|---|---|
firefox35 | --- | fixed |
People
(Reporter: gkw, Assigned: shu)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(1 file)
1.46 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
try { let x = ((function f(y) { if (y > 0) { f(-1) } x })(1)) } catch (e) {} asserts js debug shell on m-c changeset 16ff803b47a9 with --ion-eager --no-threads at Assertion failure: data.s.payload.why == why, at dist/include/js/Value.h. Debug configure flags: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests === Tinderbox Build Bisection Results by autoBisect === The "good" changeset has the timestamp "20140915155135" and the hash "170ce237e4a0". The "bad" changeset has the timestamp "20140915164436" and the hash "b7f4709b34c3". Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=170ce237e4a0&tochange=b7f4709b34c3 Shu-yu, is bug 1001090 a possible regressor? (Assuming related to the let changes)
Flags: needinfo?(shu)
Assignee | ||
Comment 1•10 years ago
|
||
Attachment #8496371 -
Flags: review?(jdemooij)
Assignee | ||
Updated•10 years ago
|
Flags: needinfo?(shu)
Comment 2•10 years ago
|
||
Comment on attachment 8496371 [details] [diff] [review] Check for uninitialized lexical bindings in FetchName and friends. Review of attachment 8496371 [details] [diff] [review]: ----------------------------------------------------------------- Can you add the testcase?
Attachment #8496371 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 3•10 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/992946f2286a
Updated•10 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Comment 4•10 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 835ef55e175e).
Reporter | ||
Comment 5•10 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/992946f2286a
Assignee: nobody → shu
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update]
Target Milestone: --- → mozilla35
You need to log in
before you can comment on or make changes to this bug.
Description
•