IonMonkey: "Assertion failure: index < stackPosition_,"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: efaust)

Tracking

(Blocks: 2 bugs, {assertion, regression, testcase})

Other Branch
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [fuzzblocker])

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 648508 [details]
stack from Windows 7

for(a in b){}

asserts js debug shell on IonMonkey changeset 9f3dc298e25b with --ion-eager at Assertion failure: index < stackPosition_,
(Assignee)

Comment 1

5 years ago
Created attachment 648576 [details] [diff] [review]
Fix
Assignee: general → efaust
Status: NEW → ASSIGNED
Attachment #648576 - Flags: review?(dvander)
Comment on attachment 648576 [details] [diff] [review]
Fix

Review of attachment 648576 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!
Attachment #648576 - Flags: review?(dvander) → review+
(Assignee)

Comment 3

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/0ba21d7a4c62
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.