Closed Bug 858085 Opened 11 years ago Closed 11 years ago

BaselineCompiler: [jsdbg2] Assertion failure: IsValidKind(kind), at ion/BaselineIC.h:718

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 857580

People

(Reporter: decoder, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update]) 

The following testcase asserts on mozilla-central revision c232bec6974d (run with --ion-eager):


gczeal(4);
var g = newGlobal('new-compartment');
var dbg = Debugger(g);
dbg.onDebuggerStatement = function (frame) {
    function hit(frame) {
        return {with : frame.eval("new Error('PASS')").return};
    }
    var s = frame.script;
    var offs = s.getLineOffsets(g.line0 + 3);
    for (var i = 0; i < offs.length; i++)
        s.setBreakpoint(offs[i], {hit: hit});
};
g.eval("\
       line0 = Error().lineNumber;\n\
       debugger;\n\
       try {\n} catch (exc) {}\n\
");
Blocks: BaselineFuzz
Whiteboard: [jsbugmon:update,bisect]
Verified fixed by the patch in bug 857580.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   127445:f82354e0b843
user:        Jan de Mooij
date:        Tue Mar 26 19:23:24 2013 +0100
summary:     Bug 854052 - Mark stub pointers stored in stub frames. r=djvj

This iteration took 142.289 seconds to run.
You need to log in before you can comment on or make changes to this bug.