Closed Bug 649937 Opened 13 years ago Closed 13 years ago

TI: Assertion failure: !f.script()->failedBoundsCheck, at ./methodjit/StubCalls.cpp:2894

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
All
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase) 

The following testcase asserts on TI revision a3eeee8f7803 (run with -m -n -a),
tested on 32 and 64 bit:

var gTestcases = new Array;
var gTc = gTestcases;
function TestCase(n, d, e, a) {
  this.description=d;
  gTestcases[gTc++]=this; 
}
function writeTestCaseResult( expect, actual, string ) {};
new TestCase;
test();
function test() {
  for ( gTc=0; ;  ) {    
    gTestcases[gTc].description+=" )";
    gTestcases=[1,];
  }
}
WFM, fixed by rev dca50d9a5047 I think.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.