Closed
Bug 893853
Opened 10 years ago
Closed 10 years ago
Assertion failure: !types->unknown(), at ../ion/MIR.h:7396
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla25
People
(Reporter: decoder, Assigned: h4writer)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])
Attachments
(2 files)
728 bytes,
text/plain
|
Details | |
1.57 KB,
patch
|
bhackett1024
:
review+
bajaj
:
approval-mozilla-aurora+
|
Details | Diff | Splinter Review |
The following testcase asserts on mozilla-central revision 18467a85acf6 (run with --fuzzing-safe --ion-eager): function f() {} new EvalTest(); function EvalTest() { with (this) { f(EvalTest) } } evaluate("var obj = new f(1, 'x');");
Reporter | ||
Comment 1•10 years ago
|
||
Reporter | ||
Updated•10 years ago
|
Whiteboard: [jsbugmon:update,bisect]
Reporter | ||
Updated•10 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 2•10 years ago
|
||
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/436c88ed1e5e user: Hannes Verschore date: Tue Jun 11 16:00:54 2013 +0200 summary: Bug 879168 - IonMonkey: Improve the typeset of |this| when inlining a constructing call, r=bhackett This iteration took 326.199 seconds to run.
Reporter | ||
Comment 3•10 years ago
|
||
Needinfo from Hannes based on comment 2 :)
Flags: needinfo?(hv1989)
Assignee | ||
Comment 4•10 years ago
|
||
Assignee: general → hv1989
Attachment #775942 -
Flags: review?(bhackett1024)
Flags: needinfo?(hv1989)
Updated•10 years ago
|
Attachment #775942 -
Flags: review?(bhackett1024) → review+
Assignee | ||
Updated•10 years ago
|
Assignee | ||
Comment 5•10 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/84e608715045
Comment 6•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/84e608715045
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
Assignee | ||
Comment 7•10 years ago
|
||
Comment on attachment 775942 [details] [diff] [review] Patch [Approval Request Comment] Bug caused by (feature/regressing bug #): Bug 879168 User impact if declined: I think nothing too crazy. But there is a reason there is an assert there. Not sure if it is due to crashes or bailouts, though. Testing completed (on m-c, etc.): m-c for the weekend Risk to taking this patch (and alternatives if risky): I would say no risk. Very easy and understandable patch. String or IDL/UUID changes made by this patch: /
Attachment #775942 -
Flags: approval-mozilla-aurora?
Updated•10 years ago
|
Attachment #775942 -
Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Updated•10 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•