Closed Bug 1216156 Opened 7 years ago Closed 7 years ago

Assertion failure: analysis().usesScopeChain(), at jit/IonBuilder.cpp

Categories

(Core :: JavaScript Engine: JIT, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1216126
Tracking Status
firefox44 --- affected

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

(function() {
    x = 0;
    new(1 for (x in []));
    const x = 5;
})()

asserts js debug shell on m-c changeset e8c7dfe727cd with --fuzzing-safe --no-threads --ion-eager at Assertion failure: analysis().usesScopeChain(), at jit/IonBuilder.cpp

Configure options:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --disable-threadsafe --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r e8c7dfe727cd

=== Treeherder Build Bisection Results by autoBisect ===

The "good" changeset has the timestamp "20151016163631" and the hash "4690eec6b6583f4fd01b8b60be3ce6867d85ed78".
The "bad" changeset has the timestamp "20151016175031" and the hash "97e02e8d43a140b5389bd50acfd0bc33d1cd5aea".

Likely regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=4690eec6b6583f4fd01b8b60be3ce6867d85ed78&tochange=97e02e8d43a140b5389bd50acfd0bc33d1cd5aea

Shu-yu, is bug 1215341 a likely regressor?
Flags: needinfo?(shu)
Status: NEW → RESOLVED
Closed: 7 years ago
Flags: needinfo?(shu)
Resolution: --- → DUPLICATE
Duplicate of bug: 1216126
Group: javascript-core-security
You need to log in before you can comment on or make changes to this bug.