IonMonkey: "Assertion failure: hasGlobal(),"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: gkw, Assigned: dvander)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 594776 [details]
stack

de = N = K = E = l = p = n = function() {}
function e() {}
function tryItOut(code) {
    d = f = Function(code)
    f()
}
function t() {}
function ne() {}
a = eval
function r() {}
s = v = false
function f4() {}
o = 9
tryItOut("for(b in((Object.create)(this))){}")

asserts js debug shell on IonMonkey changeset 186084ff8e63 with -m, --ion and -n at Assertion failure: hasGlobal(),
(Reporter)

Comment 1

5 years ago
Still repros on changeset a1fc5b03be76.
(Assignee)

Comment 2

5 years ago
Created attachment 594857 [details] [diff] [review]
fix
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #594857 - Flags: review?(bhackett1024)
Attachment #594857 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 3

5 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/142b4500e832
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug724654.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.