Last Comment Bug 657197 - TI: "Assertion failure: bad,"
: TI: "Assertion failure: bad,"
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: jsfunfuzz infer-regress
  Show dependency treegraph
 
Reported: 2011-05-14 22:20 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:05 PST (History)
4 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
stack (3.05 KB, text/plain)
2011-05-14 22:20 PDT, Gary Kwong [:gkw] [:nth10sd]
no flags Details

Description Gary Kwong [:gkw] [:nth10sd] 2011-05-14 22:20:26 PDT
Created attachment 532495 [details]
stack

(function() {
  new function() {
    throw [];
  }
})()

asserts js debug shell on JM changeset ef1ce31f66b9 with -n at Assertion failure: bad
Comment 1 Brian Hackett (:bhackett) 2011-05-15 23:34:21 PDT
When analyzing the properties created when 'new' is called on a script, we assumed that there was a reachable return statement in the script.  This may not hold if the script always throws.

http://hg.mozilla.org/projects/jaegermonkey/rev/88112acd3094
Comment 2 Christian Holler (:decoder) 2013-01-14 08:05:50 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug657197.js.

Note You need to log in before you can comment on or make changes to this bug.