Closed Bug 496687 Opened 15 years ago Closed 15 years ago

TM: "Assertion failure: isNumber(*p) == (t == JSVAL_DOUBLE), at ../jstracer.cpp"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 496743

People

(Reporter: gkw, Assigned: gal)

References

Details

(Keywords: assertion, regression, testcase) 

for each(c in [new Boolean(true), new Number(), new String, new Boolean(true), new String(), new Boolean(true), new Boolean(true), new Number()]) {
    for each(a in [new String(), new String]) {
        print(c += (0 > c))
    }
} s

asserts debug js shell with -j at Assertion failure: isNumber(*p) == (t == JSVAL_DOUBLE), at ../jstracer.cpp:2049 on mozilla-1.9.1 branch.
Flags: blocking1.9.1?
autoBisect shows this is probably related to bug 495958 :

The first bad revision is:
changeset:   28938:ea72bb61b701
user:        Andreas Gal
date:        Thu Jun 04 20:42:56 2009 -0700
summary:     When merging type maps in a side exit, use the inner tree's globals (495958, r=dvander).
Blocks: 495958
Keywords: regression
OS: Linux → All
Hardware: x86 → All
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → DUPLICATE
Flags: blocking1.9.1? → blocking1.9.1+
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.