Closed Bug 469239 Opened 16 years ago Closed 16 years ago

TM: "Assertion failure: ATOM_IS_STRING(atom)"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

js> for (let b=0;b<9;++b) { for each (let h in ['', 3, /x/]) { for each (c in [[], [], [], /x/]) { '' + c; } } } Assertion failure: entry->kpc == (jsbytecode*) atoms[index], at ../jstracer.cpp:5021 js> for (let b=0;b<9;++b) { for each (let h in [33, 3, /x/]) { for each (c in [[], [], [], /x/]) { '' + c; } } } Assertion failure: ATOM_IS_STRING(atom), at ../jstracer.cpp:6985 Regression from bug 465460.
v12 (bug 465460 comment 50) fixes this.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
I can't reproduce these but will add the tests anyway.
http://hg.mozilla.org/tracemonkey/rev/905c89ddc8a1 /cvsroot/mozilla/js/tests/js1_7/regress/regress-469239-01.js,v <-- regress-469239-01.js initial revision: 1.1 /cvsroot/mozilla/js/tests/js1_7/regress/regress-469239-02.js,v <-- regress-469239-02.js initial revision: 1.1
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.