Closed Bug 779020 Opened 7 years ago Closed 7 years ago

IonMonkey: TypeFailure on tests/content/base/test/test_bug682592.html

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED DUPLICATE of bug 774953

People

(Reporter: dvander, Unassigned)

References

()

Details

(Whiteboard: [ion:p1:fx18][sg:dupe 774953])

Attachments

(1 file)

This failure appears on TBPL, mochitest column 1. URL contains a sample log.

Stack:

 0  XUL!js::types::TypeFailure [jsinfer.cpp : 328 + 0x0]
    rbx = 0x700842f8   r12 = 0x00000000   r13 = 0x49b24d00   r14 = 0x5fbf9760
    r15 = 0x5fbf9360   rip = 0x034424b1   rsp = 0x5fbf9290   rbp = 0x5fbf9b80
    Found by: given as instruction pointer in context
Attached file Test case
Wasn't easy to reduce, but this testcase fails with |javascript.options.methodjit_always| set to true. Doesn't require Ion so this is most likely from the TI/DOM changes.
Eric can you take a look at this? Thanks!
Group: core-security
This also fails on central. Marking as fuzz-bug dupe.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 774953
Whiteboard: [ion:p1:fx18] → [ion:p1:fx18][sg:dupe 774953]
Group: core-security
You need to log in before you can comment on or make changes to this bug.