Closed
Bug 725003
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: js_CheckForStringIndex(id) == id, at js/src/jsatom.h:107
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: dvander)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
2.59 KB,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on ionmonkey revision c34398f961e7 (run with --ion -n), tested on 64 bit: function TestCase(n, d, e, a) { this.name = n; this.description = d; this.expect = e; this.actual = a; this.passed = getTestCaseResult(e, a); this.reason = ''; } function getTestCaseResult(expected, actual) {} var obj = new Function(); for (var i = 0; i < 100; i++) { obj['-1'] = new Array(); assertEq(obj['-1'] == null, false); obj = new TestCase(); }
Assignee | ||
Comment 1•12 years ago
|
||
Long-term we should probably use lookupProperty but for now this is fine.
Assignee | ||
Updated•12 years ago
|
Attachment #595547 -
Flags: review? → review?(bhackett1024)
Updated•12 years ago
|
Attachment #595547 -
Flags: review?(bhackett1024) → review+
Assignee | ||
Comment 2•12 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/63d066d8186b
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 3•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug725003.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•