Closed
Bug 756918
Opened 12 years ago
Closed 12 years ago
Assertion failure: block_->needsClone(), at vm/ScopeObject.cpp:1216
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla15
People
(Reporter: decoder, Assigned: luke)
Details
(Keywords: assertion, testcase, Whiteboard: [js:t])
Attachments
(1 file)
|
1.26 KB,
patch
|
Waldo
:
review+
|
Details | Diff | Splinter Review |
The following test asserts on mozilla-central revision d55df2c9c037 (no options required):
with({})
let([] = 6 ? this : this) {
eval("enum = true;");
}
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 94413:f45eec2bd4c7
user: Luke Wagner
date: Tue Dec 20 17:42:45 2011 -0800
summary: Bug 690135 - create scope objects eagerly or not at all (r=jimb)
|
Assignee | |
Comment 1•12 years ago
|
||
Blah, empty destructuring let. Might as well preserve the assert. Simple fix.
|
||
Updated•12 years ago
|
Whiteboard: js-triage-needed → [js:t]
|
|
||
Comment 2•12 years ago
|
||
jsfunfuzz hits this constantly, too.
|
||
Updated•12 years ago
|
Attachment #625533 -
Flags: review?(jwalden+bmo) → review+
|
|
Assignee | |
Comment 3•12 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/1c64ae5ff661
Target Milestone: --- → mozilla15
|
||
Comment 4•12 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/1c64ae5ff661
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•