Assertion failure: ionScript->containsReturnAddress(returnAddr), at ion/IonFrames.cpp

RESOLVED FIXED in mozilla25

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: shu)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla25
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 769603 [details]
stack

z = Object.defineProperty(this, "x", {
    get: function() {
        return ParallelArray([221], (function() {
            (function(y) {
                z.h
            })()
        }))
    }
})
x

asserts 32-bit threadsafe js debug shell on m-c changeset e24391ffbe7e without any CLI arguments at Assertion failure: ionScript->containsReturnAddress(returnAddr), at ion/IonFrames.cpp

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/286594159989
user:        Shu-yu Guo
date:        Wed Apr 10 11:04:24 2013 -0700
summary:     Bug 846111 - Part 3: Dispatch style ICs in Ion and ParallelGetPropertyIC. (r=nbp)
Flags: needinfo?(shu)
(Assignee)

Comment 1

5 years ago
Created attachment 769617 [details] [diff] [review]
fix
Assignee: general → shu
Attachment #769617 - Flags: review?(jdemooij)
Flags: needinfo?(shu)

Updated

5 years ago
Attachment #769617 - Flags: review?(jdemooij) → review+
(Assignee)

Updated

5 years ago
Duplicate of this bug: 888555
https://hg.mozilla.org/mozilla-central/rev/bbda33d547a9
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.