Closed Bug 583141 Opened 14 years ago Closed 14 years ago

JM: jsreftest assert on js1_8\regress\regress-464418.js

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: dmandelin, Assigned: dmandelin)

References

Details

Assertion failure: thing, at c:/sources/moo/js/src/jsgc.cpp:2150
WFM as of bc6c3120b042. This looks like a bug related to value tearing and GC (it asserted in the mark phase on a value tagged as object with payload 0), so it makes sense that conservative GC would fix it.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.