Last Comment Bug 651827 - TI: "Assertion failure: v_.s.tag != JSVAL_TAG_CLEAR,"
: TI: "Assertion failure: v_.s.tag != JSVAL_TAG_CLEAR,"
: assertion, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
-- critical (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz js-differential-test infer-regress 649693
  Show dependency treegraph
Reported: 2011-04-21 02:30 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-19 13:57 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

stack (3.95 KB, text/plain)
2011-04-21 02:30 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description User image Gary Kwong [:gkw] [:nth10sd] 2011-04-21 02:30:31 PDT
Created attachment 527501 [details]

try {
    function x() {}
} catch(e) {}
switch (undefined) {
    case(y) = Infinity:

asserts js debug shell on JM changeset 1fe03044bfeb with -m, -a and -n at Assertion failure: v_.s.tag != JSVAL_TAG_CLEAR,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   68213:244446b156b7
user:        Brian Hackett
date:        Sat Apr 16 06:54:01 2011 -0700
summary:     [INFER] LICM and bounds check hoisting for x.length, bug 649693.
Comment 1 User image Brian Hackett (:bhackett) 2011-04-23 22:55:07 PDT
Simple bogus assertion, we were asserting the consistency of a different value from the one which we were about to access (needed to assert on a FrameEntry's backing's data rather than the FrameEntry itself).
Comment 2 User image Christian Holler (:decoder) 2013-01-19 13:57:41 PST
Automatically extracted testcase for this bug was committed:

Note You need to log in before you can comment on or make changes to this bug.