Closed Bug 914586 Opened 6 years ago Closed 6 years ago

Crash [@ IsCacheableSetPropCallNative]

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 913716

People

(Reporter: decoder, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase, Whiteboard: [jsbugmon:update])

Crash Data

Attachments

(1 file)

The following testcase crashes on mozilla-central revision be1053dc223b (run with --ion-eager):


Object.defineProperty(this, "x", { set: undefined });
evaluate("var x = -0.1;");
Whiteboard: [jsbugmon:update,bisect]
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/6f82c0e76f2d
user:        Eric Faust
date:        Fri Aug 30 18:50:36 2013 -0700
summary:     Bug 904827 - Part 2: Implement JSNative setter calls in SetPropertyIC. (r=djvj)

This iteration took 1.279 seconds to run.
Needinfo from Eric, based on comment 2 :)
Flags: needinfo?(efaustbmo)
Found by Gary and originally filed as 913716. Fix up there.
Status: NEW → RESOLVED
Closed: 6 years ago
Flags: needinfo?(efaustbmo)
Resolution: --- → DUPLICATE
Duplicate of bug: 913716
You need to log in before you can comment on or make changes to this bug.