Closed
Bug 928268
Opened 12 years ago
Closed 12 years ago
"Assertion failure: !uninlinedIsProxy()" with ion eager in browser
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla27
People
(Reporter: jruderman, Assigned: bhackett1024)
Details
(Keywords: assertion, testcase)
Attachments
(3 files)
With:
user_pref("javascript.options.ion.unsafe_eager_compilation", true);
the testcase trips:
Assertion failure: !uninlinedIsProxy(), at js/src/jsobj.h:466
Reporter | ||
Comment 1•12 years ago
|
||
Comment 2•12 years ago
|
||
Do you have a regression range?
Comment 3•12 years ago
|
||
Based on the stack it's probably a regression from the recent TI changes.
Flags: needinfo?(bhackett1024)
Assignee | ||
Comment 4•12 years ago
|
||
This assert is bogus, getProto() will return a 0x1 JSObject* for proxies with a lazy prototype, but this call site will immediately coerce that JSObject* into a TaggedProto and callers will handle the 0x1 correctly.
Assignee: nobody → bhackett1024
Attachment #819035 -
Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Updated•12 years ago
|
Attachment #819035 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 6•12 years ago
|
||
Comment 7•12 years ago
|
||
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
You need to log in
before you can comment on or make changes to this bug.
Description
•