IonMonkey: "Assertion failure: isObject(),"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: dvander)

Tracking

(Blocks: 2 bugs, {assertion, regression, testcase})

Other Branch
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 636045 [details]
stack

eval("\
    \"use strict\";\
    a();\
    function a() {\
        print\
    }\
")

asserts js debug shell on IonMonkey changeset 05a756967f25 with --ion-eager at Assertion failure: isObject(), 

Due to skipped revisions, the first bad revision could be any of:
changeset:   87140:f46cfb199e77
user:        Sean Stangl
date:        Mon Feb 06 17:15:24 2012 -0800
summary:     Make native calls faster. (Bug 721031, r=dvander)

changeset:   87141:2ce3daef5bd2
user:        Sean Stangl
date:        Mon Feb 06 17:55:48 2012 -0800
summary:     Fix warnings. (Bug 721031, red)
(Assignee)

Comment 1

5 years ago
Created attachment 639442 [details] [diff] [review]
fix
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #639442 - Flags: review?
(Assignee)

Updated

5 years ago
Attachment #639442 - Flags: review? → review?(sstangl)

Updated

5 years ago
Attachment #639442 - Flags: review?(sstangl) → review+
(Assignee)

Comment 2

5 years ago
This is fixed with the most recent mozilla-central merge.
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.