IonMonkey: Assertion failure: thisValue.isObject() || thisValue.isUndefined() || thisValue.isNull(), at builtin/Eval.cpp:367

RESOLVED FIXED

Status

()

--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86_64
Linux
assertion, regression, testcase
Points:
---
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(firefox33 fixed, firefox34 fixed, firefox35 fixed, firefox36 fixed, firefox-esr31 fixed)

Details

(Whiteboard: [jsbugmon:update])

(Reporter)

Description

6 years ago
The following testcase asserts on mozilla-central revision e162098b76d9 (run with --ion-eager):


function testEvalThrow(x, y) {
  eval("");
}
for (var i = 0; i < 5; i++)
  testEvalThrow.call("");
A fix for this seems to be in bug 844364.
(Reporter)

Updated

6 years ago
Whiteboard: [jsbugmon:update,bisect,bisectfix]
(Reporter)

Updated

6 years ago
Whiteboard: [jsbugmon:update,bisect,bisectfix] → [jsbugmon:update,ignore]
(Reporter)

Comment 2

6 years ago
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 47876c1d1c45).
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   122539:dc30947a2d26
user:        Brian Hackett
date:        Thu Feb 21 05:38:44 2013 -0700
summary:     Bug 842305 - Watch for null payloads flowing into Ion, r=jandem.

This iteration took 110.307 seconds to run.

JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   122946:0f9bcf85f0b7
user:        Brian Hackett
date:        Mon Feb 25 15:17:12 2013 -0700
summary:     Bug 844364 - Fix bogus assertion, inverted test when compiling JSOP_EVAL, r=jandem.

This iteration took 120.604 seconds to run.
(Assignee)

Updated

4 years ago
Assignee: general → nobody
The testcases in this bug and bug 844364 both involve eval, so I guess in addition to comment 2 it's safe to say it's fixed by bug 844364 as well.
Status: NEW → RESOLVED
Last Resolved: 4 years ago
status-firefox33: --- → fixed
status-firefox34: --- → fixed
status-firefox35: --- → fixed
status-firefox36: --- → fixed
status-firefox-esr31: --- → fixed
Flags: in-testsuite?
Keywords: regression
Resolution: --- → FIXED
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update]
You need to log in before you can comment on or make changes to this bug.