Closed
Bug 651827
Opened 13 years ago
Closed 13 years ago
TI: "Assertion failure: v_.s.tag != JSVAL_TAG_CLEAR,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(1 file)
3.95 KB,
text/plain
|
Details |
try { function x() {} } catch(e) {} switch (undefined) { case(y) = Infinity: } asserts js debug shell on JM changeset 1fe03044bfeb with -m, -a and -n at Assertion failure: v_.s.tag != JSVAL_TAG_CLEAR, autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 68213:244446b156b7 user: Brian Hackett date: Sat Apr 16 06:54:01 2011 -0700 summary: [INFER] LICM and bounds check hoisting for x.length, bug 649693.
Comment 1•13 years ago
|
||
Simple bogus assertion, we were asserting the consistency of a different value from the one which we were about to access (needed to assert on a FrameEntry's backing's data rather than the FrameEntry itself). http://hg.mozilla.org/projects/jaegermonkey/rev/96b40c951d15
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Comment 2•11 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•