Closed
Bug 934997
Opened 12 years ago
Closed 12 years ago
Assertion failure: !empty(), at ../vm/Shape.h:1030 or Crash [@ js::ScopeCoordinateName]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla28
People
(Reporter: decoder, Assigned: jandem)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(1 file)
|
735 bytes,
text/plain
|
Details |
The following testcase asserts on mozilla-central revision 770de5942471 (no options required):
function test() {
var BUGNUMBER = '';
var summary = '';
function g() {
'use strict';
try {
eval('function foo() { var a, arguments, b;}');
} catch (x) {
return (x instanceof summary);
}
};
g();
} test();
|
Reporter | |
Comment 1•12 years ago
|
||
|
|
Reporter | |
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisect]
|
|
Reporter | |
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
|
|
Reporter | |
Comment 2•12 years ago
|
||
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: http://hg.mozilla.org/mozilla-central/rev/495a9c210b91
user: Jan de Mooij
date: Mon Nov 04 11:40:24 2013 +0100
summary: Bug 933798 - Don't unnecessarily deoptimize name accesses in try blocks in lazily parsed functions. r=bhackett
This iteration took 423.210 seconds to run.
|
|
Reporter | |
Updated•12 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
|
|
Reporter | |
Comment 3•12 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 5446435cc94a).
|
||
Comment 4•12 years ago
|
||
This was fixed by backing out bug 933798.
Status: NEW → RESOLVED
Closed: 12 years ago
Flags: in-testsuite?
Keywords: regression
Resolution: --- → FIXED
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update]
|
||
Updated•12 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•