Closed Bug 846295 Opened 11 years ago Closed 11 years ago

BaselineCompiler: Assertion failure: !vp.isMagic(), at jsobj.cpp:3650

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED DUPLICATE of bug 846330

People

(Reporter: decoder, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,ignore]) 

The following testcase asserts on baseline compiler branch revision a261716e1b62 (run with --ion-eager):


function strictNestedEval(code, p) {
  function inner() { eval(code); }
  inner();
}
a1 = strictNestedEval("1", 2);
a2 = strictNestedEval("arguments");
Depends on: 846330
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision f8f0facf81ec).
Bug 846330 fixed this. Setting in-testsuite+ since the testcase added in that bug is just slightly modified from the one in comment 0 and triggered the same assert on the baseline branch.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: in-testsuite+
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.