Closed Bug 585391 Opened 11 years ago Closed 11 years ago

JM: "Assertion failure: v.isObject(),"

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

var x = (function () {
    return [, , ]
}());
(function () {
    while (x > 7 & 0) {
        return
    }
}())

asserts js debug shell on JM changeset 787e35063545 with -m at Assertion failure: v.isObject(), at ../jsnum.cpp:1178 when passed in as a CLI argument.
More syncExit() misuse on my behalf :(

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/d45296cdc411
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug585391.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.