Closed Bug 809468 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: inst->is<InstCMP>(), at ion/arm/Assembler-arm.cpp:2409

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
ARM
Linux
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED DUPLICATE of bug 808067

People

(Reporter: decoder, Assigned: mjrosenb)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:ignore]) 

The following testcase asserts on mozilla-central revision 98b004c70db0 (run with --ion-eager):


var BUGNUMBER = '';
function printBugNumber (num) {
  BUGNUMBER = num;
}
function test() {
  printBugNumber(BUGNUMBER);
}
gcslice(0);
gcslice(1);
gcslice();
[""][test() !== "ok"] = (null);
gczeal(4);
S-s due to GC-relatedness.
Assignee: general → mrosenberg
Whiteboard: [jsbugmon:ignore]
Have you had a chance to look at this, Marty?
Noticed that this no longer reproduced, ran hg bisect on it, and it pointed to this commit:
The first bad revision is:
changeset:   112669:bdd3bfd15630
user:        Bill McCloskey <wmccloskey@mozilla.com>
date:        Wed Nov 07 10:30:30 2012 -0800
summary:     Bug 808067 - Fix needsBarrier for GC (r=sstangl,jonco)

This seems to be the same bug, so closing

also, fwiw, while tracking this down, I noticed that the revision listed in the description doesn't actually exist in m-c, so that may indicate a problem.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.