Closed
Bug 934997
Opened 11 years ago
Closed 11 years ago
Assertion failure: !empty(), at ../vm/Shape.h:1030 or Crash [@ js::ScopeCoordinateName]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla28
People
(Reporter: decoder, Assigned: jandem)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(1 file)
735 bytes,
text/plain
|
Details |
The following testcase asserts on mozilla-central revision 770de5942471 (no options required): function test() { var BUGNUMBER = ''; var summary = ''; function g() { 'use strict'; try { eval('function foo() { var a, arguments, b;}'); } catch (x) { return (x instanceof summary); } }; g(); } test();
Reporter | ||
Comment 1•11 years ago
|
||
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect]
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
Reporter | ||
Comment 2•11 years ago
|
||
JSBugMon: Bisection requested, result: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/495a9c210b91 user: Jan de Mooij date: Mon Nov 04 11:40:24 2013 +0100 summary: Bug 933798 - Don't unnecessarily deoptimize name accesses in try blocks in lazily parsed functions. r=bhackett This iteration took 423.210 seconds to run.
Reporter | ||
Updated•11 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Reporter | ||
Comment 3•11 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 5446435cc94a).
Comment 4•11 years ago
|
||
This was fixed by backing out bug 933798.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: in-testsuite?
Keywords: regression
Resolution: --- → FIXED
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update]
Updated•11 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•