BaselineCompiler: Assertion failure: false (Unexpected state), at vm/Stack.cpp:1867

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update,reconfirm,ignore])

(Reporter)

Description

5 years ago
The following testcase asserts on baseline compiler branch revision de894e57ecb2 (run with --ion-eager):


eval("\
var z = 0;\
function f() {\
    if (z++ > 8)\
        myfunc1.toString() , counter < 5;\
}\
try {\
    for (var i = 0; i < 10; i++)\
        new f();\
} catch(e)  {  }\
");

Updated

5 years ago
Whiteboard: [jsbugmon:update] → [jsbugmon:update,reconfirm]
(Reporter)

Updated

5 years ago
Whiteboard: [jsbugmon:update,reconfirm] → [jsbugmon:update,reconfirm,ignore]
(Reporter)

Comment 1

5 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 36b6a36c00bc).
Bug 743394 changed how evalPrev works and also fixed this bug.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.