Closed
Bug 779020
Opened 13 years ago
Closed 13 years ago
IonMonkey: TypeFailure on tests/content/base/test/test_bug682592.html
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
DUPLICATE
of bug 774953
People
(Reporter: dvander, Unassigned)
References
()
Details
(Whiteboard: [ion:p1:fx18][sg:dupe 774953])
Attachments
(1 file)
|
352 bytes,
text/html
|
Details |
This failure appears on TBPL, mochitest column 1. URL contains a sample log.
Stack:
0 XUL!js::types::TypeFailure [jsinfer.cpp : 328 + 0x0]
rbx = 0x700842f8 r12 = 0x00000000 r13 = 0x49b24d00 r14 = 0x5fbf9760
r15 = 0x5fbf9360 rip = 0x034424b1 rsp = 0x5fbf9290 rbp = 0x5fbf9b80
Found by: given as instruction pointer in context
|
||
Comment 1•13 years ago
|
||
Wasn't easy to reduce, but this testcase fails with |javascript.options.methodjit_always| set to true. Doesn't require Ion so this is most likely from the TI/DOM changes.
|
|
||
Comment 2•13 years ago
|
||
Eric can you take a look at this? Thanks!
|
Reporter | |
Updated•13 years ago
|
Group: core-security
|
||
Comment 3•13 years ago
|
||
This also fails on central. Marking as fuzz-bug dupe.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
|
||
Updated•13 years ago
|
Whiteboard: [ion:p1:fx18] → [ion:p1:fx18][sg:dupe 774953]
|
|
||
Updated•12 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•