Closed Bug 888837 Opened 6 years ago Closed 6 years ago

Assertion failure: ionScript->containsReturnAddress(returnAddr), at ion/IonFrames.cpp

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla25

People

(Reporter: gkw, Assigned: shu)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase)

Attachments

(2 files)

Attached file stack
z = Object.defineProperty(this, "x", {
    get: function() {
        return ParallelArray([221], (function() {
            (function(y) {
                z.h
            })()
        }))
    }
})
x

asserts 32-bit threadsafe js debug shell on m-c changeset e24391ffbe7e without any CLI arguments at Assertion failure: ionScript->containsReturnAddress(returnAddr), at ion/IonFrames.cpp

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/286594159989
user:        Shu-yu Guo
date:        Wed Apr 10 11:04:24 2013 -0700
summary:     Bug 846111 - Part 3: Dispatch style ICs in Ion and ParallelGetPropertyIC. (r=nbp)
Flags: needinfo?(shu)
Attached patch fixSplinter Review
Assignee: general → shu
Attachment #769617 - Flags: review?(jdemooij)
Flags: needinfo?(shu)
Attachment #769617 - Flags: review?(jdemooij) → review+
Duplicate of this bug: 888555
https://hg.mozilla.org/mozilla-central/rev/bbda33d547a9
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.