Closed Bug 585391 Opened 13 years ago Closed 13 years ago

JM: "Assertion failure: v.isObject(),"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase) 

var x = (function () {
    return [, , ]
}());
(function () {
    while (x > 7 & 0) {
        return
    }
}())

asserts js debug shell on JM changeset 787e35063545 with -m at Assertion failure: v.isObject(), at ../jsnum.cpp:1178 when passed in as a CLI argument.
More syncExit() misuse on my behalf :(

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/d45296cdc411
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug585391.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.