Closed
Bug 1077349
Opened 10 years ago
Closed 10 years ago
Assertion failure: isInitialized(), at jit/IonFrames.cpp:1494
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1075488
Tracking | Status | |
---|---|---|
firefox35 | --- | affected |
People
(Reporter: decoder, Assigned: nbp)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(1 file)
454 bytes,
text/plain
|
Details |
The following testcase asserts on mozilla-central revision b85c260821ab (run with --no-threads --fuzzing-safe --baseline-eager --ion-eager): eval("(function () {\ function boo() {\ return foo.arguments[0];\ }\ function foo(a,b,c) {\ if (a == 0) {\ a ^= (1);\ return boo();\ }\ }\ function inlined() {\ return foo.apply({}, arguments);\ }\ assertEq(inlined(1,2,3), undefined);\ assertEq(inlined(0,(1),3), 0);\ })();");
Reporter | ||
Comment 1•10 years ago
|
||
Reporter | ||
Comment 2•10 years ago
|
||
Marked s-s because the assertion indicates that something might be used although it's not initialized properly. The test does not crash though.
status-firefox35:
--- → affected
Whiteboard: [jsbugmon:update,bisect]
Reporter | ||
Updated•10 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 3•10 years ago
|
||
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/2178d3ceaee1 user: Nicolas B. Pierron date: Tue Sep 23 19:42:35 2014 +0200 summary: Bug 1062869 part 6 - Handle early execution of recover instructions. r=h4writer This iteration took 311.847 seconds to run.
Updated•10 years ago
|
Assignee | ||
Comment 4•10 years ago
|
||
This looks like a duplicate of Bug 1075488, I will verify tomorrow.
Assignee | ||
Comment 5•10 years ago
|
||
This is indeed a duplicate of Bug 1075488 that I found while fixing other issues related to scalar replacement. I will still land the test case as it is interesting to have in the test suite.
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(nicolas.b.pierron)
Resolution: --- → DUPLICATE
Assignee | ||
Comment 6•10 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/a1a6b6736374
Group: core-security
https://hg.mozilla.org/mozilla-central/rev/a1a6b6736374
Assignee: nobody → nicolas.b.pierron
You need to log in
before you can comment on or make changes to this bug.
Description
•