765487 - IonMonkey: Assertion failure: needsBarrier_, at ../../jscompartment.h:142

Status: RESOLVED DUPLICATE of bug 761854

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision de23a9fc29db (run with --ion -n -m --ion-eager):


function TestCase(n, d, e, a)
  this.reason = '';
function reportCompare (expected, actual, description) {
  var output = "";
  var testcase = new TestCase("unknown-test-name", description, expected, actual);
  testcase.reason = output;
}
function compareSource(expect, actual, summary) {
  var expectP = expect.replace(/new (\w+)\s*\(\s*\)/mg, 'new $1');
  var actualP = actual.replace(/new (\w+)\s*\(\s*\)/mg, 'new $1');
  reportCompare(expectP, actualP, summary);
}
p = Proxy.create({
  has: function() {}
})
Object.prototype.__proto__ = p
gczeal(4);
var summary = 'Do not assert: newtop <= oldtop, decompiling function';
var actual = 'No Crash';
var expect = 'No Crash';
compareSource((expect), actual, summary);
reportCompare(expect, actual, summary);
gczeal(2);
reportCompare(expect, actual, summary + ': catch');

Comment 1

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 3112408514c8).

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

This was fixed by bug 761854 I think - it was actually fixed by a merge according to hg bisect, but the specific problem here is exactly bug 761854.