Closed
Bug 1050847
Opened 10 years ago
Closed 10 years ago
Assertion failure: conversion != MToDouble::NumbersOnly, at jit/Lowering.cpp:1745
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1054512
| Tracking | Status | |
|---|---|---|
| firefox32 | --- | unaffected |
| firefox33 | --- | affected |
| firefox34 | --- | affected |
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:])
Attachments
(1 file)
|
(deleted),
text/plain
|
Details |
The following testcase asserts on mozilla-central revision 698ae2f2c8bf (run with --no-threads --fuzzing-safe --ion-eager):
function TestCase(e, a)
getTestCaseResult(e, a);
function reportCompare (expected, actual, description) {
printStatus ();
new TestCase(expected, actual);
}
function getTestCaseResult(expected, actual) {
return actual == expected;
}
try { test(); } catch(exc1) {}
function test() {
reportCompare();
}
new TestCase(Math.max(-1,-.99999999999999));
var sym = Symbol("method");
var obj = {
__noSuchMethod__: function (key, args) {
reportCompare(key, sym);
}
};
obj[sym]("hello", "world");
|
Reporter | |
Comment 1•10 years ago
|
||
|
|
Reporter | |
Comment 2•10 years ago
|
||
Marked this one s-s because the assertion sounds like some conversion might be going wrong. Needinfo from jorendorff because the test uses "Symbol".
Flags: needinfo?(jorendorff)
Whiteboard: [jsbugmon:update,bisect]
|
||
Updated•10 years ago
|
status-firefox32:
--- → unaffected
status-firefox33:
--- → affected
status-firefox34:
--- → affected
|
|
Reporter | |
Updated•10 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update,bisect,ignore]
|
|
Reporter | |
Comment 3•10 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision a38daccaa557).
|
|
Reporter | |
Updated•10 years ago
|
Whiteboard: [jsbugmon:update,bisect,ignore] → [jsbugmon:bisectfix]
|
|
Reporter | |
Updated•10 years ago
|
Whiteboard: [jsbugmon:bisectfix] → [jsbugmon:]
|
|
Reporter | |
Comment 4•10 years ago
|
||
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first good revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/43494708df76
user: Hannes Verschore
date: Mon Aug 18 21:37:10 2014 +0200
summary: Bug 1054512: IonMonkey: Run the type policy of added instructions during type analysis, r=jandem
This iteration took 352.535 seconds to run.
|
||
Updated•10 years ago
|
QA Contact: kamiljoz
|
|
||
Updated•10 years ago
|
Blocks: harmony:symbols
|
||
Updated•10 years ago
|
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(jorendorff)
Flags: needinfo?(hv1989)
Resolution: --- → DUPLICATE
|
||
Updated•9 years ago
|
Group: core-security → core-security-release
|
||
Updated•8 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•