Closed Bug 862708 Opened 7 years ago Closed 7 years ago

Crash [@ js::ion::ParallelArrayVisitor::visitCall] or Assertion failure: calleeTypes, at ion/ParallelArrayAnalysis.cpp with bug 804676 fixes

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Assigned: bhackett)

References

(Blocks 1 open bug)

Details

(4 keywords)

Crash Data

Attachments

(2 files)

Attached file debug and opt stacks
try {
    ParallelArray(9, wrapWithProto(function () {}, function () {}))
} catch (e) {}

asserts js debug shell on ionmonkey (where bug 804676 fixes landed for testing) changeset d746d516bf55 without any CLI arguments at Assertion failure: calleeTypes, at ion/ParallelArrayAnalysis.cpp and crashes js opt shell at js::ion::ParallelArrayVisitor::visitCall
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
Fix this and bug 862699.  Both are simple issues.

https://hg.mozilla.org/projects/ionmonkey/rev/ae6a2cf914f7
Attachment #738772 - Flags: review?(dvander)
Flags: needinfo?(bhackett1024)
Attachment #738772 - Flags: review?(dvander) → review+
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Assignee: general → bhackett1024
You need to log in before you can comment on or make changes to this bug.