Closed Bug 899510 Opened 11 years ago Closed 11 years ago

Assertion failure: isObject(), at jsinferinlines.h

Categories

(Core :: JavaScript Engine, defect)

x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla25

People

(Reporter: gkw, Assigned: bhackett1024)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(1 file)

Attached file stack
p0 = ParallelArray([889], function() {}) var x = new ArrayBuffer(8) y = new Uint32Array(x)[0] = -3 var z = new Float32Array(x) p0.scan(function() { return z[0] }) asserts js (deterministic threadsafe 32-bit) debug shell on m-c changeset 3d40d270c031 without any CLI arguments at Assertion failure: isObject(), at jsinferinlines.h autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/0670cdaf7e9c user: Brian Hackett date: Thu Jul 11 15:08:26 2013 -0600 summary: Bug 891400 - Improve pattern matching on static typed array accesses, r=jandem.
Flags: needinfo?(bhackett1024)
autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/f0ce0463bd65 user: Brian Hackett date: Mon Jul 29 11:55:49 2013 -0600 summary: Bug 897202 - Add some double canonicalization, r=luke. Assuming fixed by bug 897202.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → FIXED
Assignee: general → bhackett1024
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: