Closed Bug 776776 Opened 12 years ago Closed 12 years ago

IonMonkey: (ARM) Assertion failure: !inBackref, at ../ion/shared/IonAssemblerBufferWithConstantPools.h:814

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
ARM
Linux
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase, Whiteboard: [ion:p1:fx18]) 

The following testcase asserts on ionmonkey revision 23a84dbb258f (run with --ion -n -m --ion-eager):


test();
function test() {
  enterFunc ('test');
  var whitespace = [
    {s : '\u0009', t : (00  )},
    {s : '\u000B', t : 'VERTICAL TAB'},
    {s : '\u000C', t : 'FORMFEED'},
    {s : '\u0020', t : 'SPACE'},
    {s : '\u00A0', t : 'NO-BREAK SPACE'},
    {s : '\u1680', t : 'OGHAM SPACE MARK'},
    {s : '\u2006', t : 'SIX-PER-EM SPACE'},
    {desc : '\u2007', t : 'FIGURE SPACE'},
    {s : '\u2008', t : (.4  )},
    {s : '\u2009', t : 'THIN SPACE'},
    {s : '\u200A', t : 'HAIR SPACE'},
    {s : '\u202F', t : 'NARROW NO-BREAK SPACE'},
    {s : '\u205F', t : 'MEDIUM MATHEMATICAL SPACE'},
    {s : '\u3000', t : 'IDEOGRAPHIC SPACE'},
    ];
  for (var i = 0; i < whitespace.length; ++i)
    reportCompare(true, !!(/\s/.test(v.s)), 'Is ' + v.t + ' a space');
}
S-s because a less reduced version gave me a SIGILL on an opt-build.
Whiteboard: [ion:p1:fx18]
Wasn't able to reproduce this on the original revision. Assuming that the repo wasn't clean and closing as WFM.
Group: core-security
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.