Closed
Bug 770762
Opened 12 years ago
Closed 12 years ago
IonMonkey: "Assertion failure: !unknownObject(),"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(1 file)
9.43 KB,
text/plain
|
Details |
function first(a) { return a[0]; } function g() { first([function() {}])(); } first([function() {}]); first([function() {}]); first([function() {}]); first([function() {}]); first([function() {}]); first([function() {}]); first([function() {}]); first([function() {}]); first([function() {}]); first([function() {}]); g(); g(); asserts js debug shell on IonMonkey changeset 5d9e10b2f586 with --no-jm and --ion-eager at Assertion failure: !unknownObject(),
Reporter | ||
Comment 1•12 years ago
|
||
Super thanks go out to Jesse for helping to reduce this testcase from being hundreds of lines long.
Reporter | ||
Comment 2•12 years ago
|
||
Note to self: 17db7530ad47 does not assert 5d9e10b2f586 asserts (not yet the smallest window)
Reporter | ||
Comment 3•12 years ago
|
||
Due to skipped revisions, the first bad revision could be any of: changeset: 99566:51c5ea99a47e user: Kannan Vijayan date: Tue Jul 03 14:36:10 2012 -0400 summary: Bug 729278 - Add IR instructions for inline function guards. (r=mjrosenb) changeset: 99567:54558ba6a5d6 user: Kannan Vijayan date: Tue Jul 03 14:37:12 2012 -0400 summary: Bug 729278 - Refactor inline_call infrastructure to prepare for polymorphic inlining. (r=mjrosenb) changeset: 99568:8523fd225c0d user: Kannan Vijayan date: Tue Jul 03 14:37:39 2012 -0400 summary: Bug 729278 - Add polymorphic inlining logic. (r=mjrosenb) changeset: 99569:c83f8157e50d user: Kannan Vijayan date: Tue Jul 03 15:40:00 2012 -0400 summary: Bug 729278 - Fix codegen for InlineFunctionGuard. (r=tbpl-red) However, it was likely fixed by: changeset: 99571:45315f6ccb19 user: Kannan Vijayan date: Tue Jul 03 17:56:08 2012 -0400 summary: Bug 729278 - Fix error in getPolyCallTargets (r=orange).
Status: NEW → RESOLVED
Closed: 12 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Reporter | ||
Comment 4•12 years ago
|
||
Kannan, will it be possible for you to check in this testcase to the testsuite?
Comment 5•12 years ago
|
||
Sure.
Comment 6•12 years ago
|
||
(see comment 4 and 5) https://hg.mozilla.org/projects/ionmonkey/rev/8b64cd2f4fab
Comment 7•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug770762.js.
Flags: in-testsuite? → in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•