Assertion failure: isObject(), at jsinferinlines.h

RESOLVED FIXED in mozilla25

Status

()

--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla25
x86
Windows 7
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Created attachment 783068 [details]
stack

p0 = ParallelArray([889], function() {})
var x = new ArrayBuffer(8)
y = new Uint32Array(x)[0] = -3
var z = new Float32Array(x)
p0.scan(function() {
    return z[0]
})

asserts js (deterministic threadsafe 32-bit) debug shell on m-c changeset 3d40d270c031 without any CLI arguments at Assertion failure: isObject(), at jsinferinlines.h

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/0670cdaf7e9c
user:        Brian Hackett
date:        Thu Jul 11 15:08:26 2013 -0600
summary:     Bug 891400 - Improve pattern matching on static typed array accesses, r=jandem.
Flags: needinfo?(bhackett1024)
(Reporter)

Comment 1

5 years ago
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f0ce0463bd65
user:        Brian Hackett
date:        Mon Jul 29 11:55:49 2013 -0600
summary:     Bug 897202 - Add some double canonicalization, r=luke.

Assuming fixed by bug 897202.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: needinfo?(bhackett1024)
Resolution: --- → FIXED
Assignee: general → bhackett1024
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.