JM: "Assertion failure: !cx->throwing, at ../methodjit/Stubs.cpp"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
8 years ago
6 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

8 years ago
(function() {
  throw (function f(a, b) {
    if (a.h == b) {
      return eval("((function(){return 1})())!=this")
    }
    f(b)
  })([], 0)
})()

asserts js debug shell on JM tip with -m and -j at Assertion failure: !cx->throwing, at ../methodjit/Stubs.cpp:3344
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug555155.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.