Closed Bug 724654 Opened 8 years ago Closed 8 years ago

IonMonkey: "Assertion failure: hasGlobal(),"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: dvander)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file stack
de = N = K = E = l = p = n = function() {}
function e() {}
function tryItOut(code) {
    d = f = Function(code)
    f()
}
function t() {}
function ne() {}
a = eval
function r() {}
s = v = false
function f4() {}
o = 9
tryItOut("for(b in((Object.create)(this))){}")

asserts js debug shell on IonMonkey changeset 186084ff8e63 with -m, --ion and -n at Assertion failure: hasGlobal(),
Still repros on changeset a1fc5b03be76.
Attached patch fixSplinter Review
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #594857 - Flags: review?(bhackett1024)
Attachment #594857 - Flags: review?(bhackett1024) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/142b4500e832
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug724654.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.