TM: Assertion failure: fp->hasCallObj(), at jsfun.cpp:248

RESOLVED FIXED in mozilla8

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Assigned: luke)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla8
x86_64
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [inbound])

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following test asserts on TM revision c2e5e424e6c3 (run with options -j -m):

function a() { 
    with(a) eval("arguments[0]"); 
} a();


This could be related to 643543 (which is not only in TI) but according to the tests I assume that this is a different defect.
(Assignee)

Comment 1

6 years ago
Created attachment 543164 [details] [diff] [review]
fix old assert

This assert is from back before bug 539144 back when hasArgsObj was true for eval frames (now its only true for the frame that owns the args obj).  This patch updates the assert and the comment.
Assignee: general → luke
Status: NEW → ASSIGNED
Attachment #543164 - Flags: review?
(Assignee)

Updated

6 years ago
Attachment #543164 - Flags: review? → review?(jwalden+bmo)
Comment on attachment 543164 [details] [diff] [review]
fix old assert

One from the vaults!
Attachment #543164 - Flags: review?(jwalden+bmo) → review+
(Assignee)

Comment 3

6 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/f317927aafcb
Whiteboard: [inbound]
http://hg.mozilla.org/mozilla-central/rev/f317927aafcb
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla8
(Reporter)

Updated

6 years ago
Blocks: 676763
(Reporter)

Comment 5

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug668479.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.