Closed
Bug 540242
Opened 15 years ago
Closed 15 years ago
TM: "Assertion failure: regs.sp[-1] == OBJECT_TO_JSVAL(fp->scopeChain), at ../jsops.cpp"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 540528
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, testcase)
for (let a = 0; a < 5; a++) { b = a } (function() { var c; eval("\ for (t in [0, 0, 0, 0]) {}\ with({}) {\ c = b\ }\ "); })() asserts js debug shell with -j on TM tip at Assertion failure: regs.sp[-1] == OBJECT_TO_JSVAL(fp->scopeChain), at ../jsops.cpp:185 autoBisect shows this is probably related to bug 495331: The first bad revision is: changeset: 37046:910ee7db07de user: David Mandelin date: Fri Jan 15 11:32:14 2010 -0800 summary: Bug 495331: trace JSOP_LAMBDA for non-heavyweight, non-null closures, r=jorendorff,dvander
Updated•15 years ago
|
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → DUPLICATE
Comment 2•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/closures/bug540242.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•