Closed
Bug 866826
Opened 11 years ago
Closed 11 years ago
Assertion failure: id == IdToTypeId(id), at ../jsinferinlines.h:1607
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla23
People
(Reporter: decoder, Unassigned)
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])
Attachments
(1 file)
719 bytes,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on mozilla-central revision 05533d50f2f7 (run with --ion-eager): function x() {} var obj = new Function(); for (var i = 0; i < 100; i++) { obj['-1'] = x; obj['-1'] == ""; }
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect]
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 1•11 years ago
|
||
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: 129593:ee14945b452c parent: 128511:d989eab66df4 user: Brian Hackett date: Thu Apr 11 18:39:32 2013 -0600 summary: Bug 804676 - Remove dependence of Ion compilation on ScriptAnalysis::analyzeTypes. This iteration took 12.099 seconds to run. Oops! We didn't test rev d989eab66df4, a parent of the blamed revision! Let's do that now. Rev d989eab66df4: Found cached shell... Testing... [Uninteresting] It didn't crash. (0.735 seconds) good (not interesting) As expected, the parent's label is the opposite of the blamed rev's label.
Reporter | ||
Comment 2•11 years ago
|
||
Brian, can you take a look? :)
Comment 3•11 years ago
|
||
Attachment #744188 -
Flags: review?(dvander)
Updated•11 years ago
|
Attachment #744188 -
Flags: review?(dvander) → review+
Comment 5•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/39aad6551764
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in
before you can comment on or make changes to this bug.
Description
•