Closed
Bug 792183
Opened 13 years ago
Closed 13 years ago
Assertion failure: [infer failure] Missing type pushed 0: <0xf6c09040>, at jsinfer.cpp:328
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 788822
People
(Reporter: decoder, Unassigned)
Details
(4 keywords, Whiteboard: [jsbugmon:update][sg:dupe 788822])
The following testcase asserts on mozilla-central revision e4757379b99a (run with --ion-eager):
function TestCase(n, d, e, a) this.path
new TestCase();
function f(y) {
("05", TestCase)();
}
for (var i = 0; i < 1000; ++i) {
f(i);
}
Reporter | ||
Comment 1•13 years ago
|
||
Could be a dup of bug 788822, but not sure.
Whiteboard: [jsbugmon:update,bisect]
Reporter | ||
Updated•13 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 2•13 years ago
|
||
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 106741:6cd206b37176
parent: 106740:b63bb39ed1c0
parent: 103644:a0240c1043ee
user: David Anderson
date: Wed Aug 29 17:51:24 2012 -0700
summary: Merge from mozilla-central.
Not all ancestors of this changeset have been checked.
To check the other ancestors, start from the common ancestor, 88e47f6905e9.
Oops! We didn't test rev a0240c1043ee, a parent of the blamed revision! Let's do that now.
We did not test rev a0240c1043ee because it is not a descendant of either 4ceb3e9961e4 or e4757379b99a.
Rev a0240c1043ee: Found cached shell... Testing... [Uninteresting] It didn't crash. (0.088 seconds)
good (not interesting)
As expected, the parent's label is the opposite of the blamed rev's label.
Updated•13 years ago
|
Keywords: sec-critical
Updated•13 years ago
|
Keywords: regression
Comment 3•13 years ago
|
||
jandem: choller guesses this is related to bug 788822. Since you investigated that bug do you agree?
Comment 4•13 years ago
|
||
(In reply to Daniel Veditz [:dveditz] from comment #3)
> jandem: choller guesses this is related to bug 788822. Since you
> investigated that bug do you agree?
Yes, this is bug 788822.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Updated•13 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update][sg:dupe 788822]
Updated•11 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•