Closed Bug 553784 Opened 12 years ago Closed 12 years ago

JM: (64-bit) "Assertion failure: cx->throwing, at ../methodjit/Stubs.cpp"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

(function(){
  (x)=<x>></x>
})()
try{
  (function(){
    ((function a(aaaaaa,bbbbbb){
      if(aaaaaa.length==bbbbbb){
        return eval%bbbbbb.valueOf()
      }
      cccccc=a(aaaaaa,bbbbbb+1)
      return cccccc._=x
    })([,,,,,,,,,,,,,,,,,,0],0))
  })()
}catch(e){}


asserts 64-bit js debug shell on JM tip with -m at Assertion failure: cx->throwing, at ../methodjit/Stubs.cpp:3231

This seems to occur as far back as this changeset:

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/cb99898f20a5
OOM and E4X. Nice combination.

http://hg.mozilla.org/users/danderson_mozilla.com/jaegermonkey/rev/f054abe132ef
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug553784.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.