Closed
Bug 637385
Opened 15 years ago
Closed 15 years ago
TM: Assertion failure: obj == globalObj, at ../jstracer.cpp:15253
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla2.0
People
(Reporter: jandem, Assigned: Waldo)
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(2 files)
|
1.68 KB,
text/plain
|
Details | |
|
2.77 KB,
patch
|
dvander
:
review+
dmandelin
:
approval2.0+
|
Details | Diff | Splinter Review |
--
"use strict";
eval("var i = 0; for(i = 0; i < 20; i++) { i = 0; }");
--
This asserts with -j in a debug build:
$ ./js -j test.js
Assertion failure: obj == globalObj, at ../jstracer.cpp:15253
Does not crash in a release build (loops infinitely but that's expected)
decoder found this bug, but asked me to file it after I reduced it.
|
Reporter | |
Comment 1•15 years ago
|
||
|
Assignee | |
Updated•15 years ago
|
Assignee: general → jwalden+bmo
|
|
Assignee | |
Comment 2•15 years ago
|
||
Attachment #515731 -
Flags: review?(dvander)
|
||
Updated•15 years ago
|
Version: unspecified → Trunk
|
|
||
Updated•15 years ago
|
Attachment #515731 -
Flags: review?(dvander) → review+
|
|
||
Comment 3•15 years ago
|
||
Nice.
/be
|
|
||
Comment 4•15 years ago
|
||
Comment on attachment 515731 [details] [diff] [review]
Patch and test
Nominating for approval because so this does not trip up fuzzers and asserts are bad.
Attachment #515731 -
Flags: approval2.0?
|
|
||
Updated•15 years ago
|
Attachment #515731 -
Flags: approval2.0? → approval2.0+
|
|
Assignee | |
Comment 5•15 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/45d79efe4418
http://hg.mozilla.org/mozilla-central/rev/c1aecf6ba5e7
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla2.0
You need to log in
before you can comment on or make changes to this bug.
Description
•