Closed
Bug 648992
Opened 14 years ago
Closed 14 years ago
TI: "Assertion failure: Call site vanished.,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, crash, testcase)
o0 = (3).__proto__
function f(o) {
var prop
[o][0][prop] = []
try {
({
x: function() {
return o
}
}.x()())
} catch (e) {}
}
f(o0)
asserts js dbg shell on JM changeset 74a8fb1bbec5 with -m, -a and -n at Assertion failure: Call site vanished., and seems to also crash opt shell.
|
||
Comment 1•14 years ago
|
||
Calling Lambda stubs can trigger recompilation.
http://hg.mozilla.org/projects/jaegermonkey/rev/265baede77e3
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
||
Comment 2•12 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•