Closed
Bug 792183
Opened 11 years ago
Closed 11 years ago
Assertion failure: [infer failure] Missing type pushed 0: <0xf6c09040>, at jsinfer.cpp:328
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 788822
People
(Reporter: decoder, Unassigned)
Details
(4 keywords, Whiteboard: [jsbugmon:update][sg:dupe 788822])
The following testcase asserts on mozilla-central revision e4757379b99a (run with --ion-eager): function TestCase(n, d, e, a) this.path new TestCase(); function f(y) { ("05", TestCase)(); } for (var i = 0; i < 1000; ++i) { f(i); }
Reporter | ||
Comment 1•11 years ago
|
||
Could be a dup of bug 788822, but not sure.
Whiteboard: [jsbugmon:update,bisect]
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 2•11 years ago
|
||
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 106741:6cd206b37176 parent: 106740:b63bb39ed1c0 parent: 103644:a0240c1043ee user: David Anderson date: Wed Aug 29 17:51:24 2012 -0700 summary: Merge from mozilla-central. Not all ancestors of this changeset have been checked. To check the other ancestors, start from the common ancestor, 88e47f6905e9. Oops! We didn't test rev a0240c1043ee, a parent of the blamed revision! Let's do that now. We did not test rev a0240c1043ee because it is not a descendant of either 4ceb3e9961e4 or e4757379b99a. Rev a0240c1043ee: Found cached shell... Testing... [Uninteresting] It didn't crash. (0.088 seconds) good (not interesting) As expected, the parent's label is the opposite of the blamed rev's label.
Updated•11 years ago
|
Keywords: sec-critical
Updated•11 years ago
|
Keywords: regression
Comment 3•11 years ago
|
||
jandem: choller guesses this is related to bug 788822. Since you investigated that bug do you agree?
Comment 4•11 years ago
|
||
(In reply to Daniel Veditz [:dveditz] from comment #3) > jandem: choller guesses this is related to bug 788822. Since you > investigated that bug do you agree? Yes, this is bug 788822.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
Updated•11 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update][sg:dupe 788822]
Updated•9 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•