The default bug view has changed. See this FAQ.

ALIASEDVAR Patch: Assertion failure: data.s.payload.why == why, at jsapi.h:470

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: luke)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

5 years ago
The following test asserts on mozilla-central revision d0430a04d92a with patch from bug 740259 (options -m -n -a):


function foo(n) {
  foo.apply = function(a, b) { return b[0]; }
  return n;
}
function bar( value ) { return foo.apply(null, arguments); }
for (var i = 0x1 ; i < 20; i++)
  assertEq(bar(i), i);
(Assignee)

Comment 1

5 years ago
Thanks!

The JSScript::applySpeculationFailed needs to inject 'unknown' into the pushed set of JSOP_ARGUMENTS, not the 'arguments' local's slot.  Fix and test-case rolled into bug 740259.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 740259

Updated

5 years ago
Resolution: DUPLICATE → FIXED
You need to log in before you can comment on or make changes to this bug.