Closed
Bug 585341
Opened 14 years ago
Closed 14 years ago
JM: "Assertion failure: IsSaneThisObject(argv[-1].toObject()),"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Assigned: cdleary)
References
Details
(Keywords: assertion, regression, testcase)
Attachments
(1 file)
|
(deleted),
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
__defineGetter__("x", Float64Array)
Function("\
with(this) {\
eval(\"x\")\
}\
")()
asserts js debug shell on JM changeset 787e35063545 with -m at Assertion failure: IsSaneThisObject(argv[-1].toObject()), at ../jsinterp.cpp:309
This occurs even after http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/b0fcf1ff31ed got checked in.
Assuming this has to do with eager this ;)
Assignee: general → cdleary
Status: NEW → ASSIGNED
|
Assignee | |
Comment 2•14 years ago
|
||
Same fix as bug 578041 but in the JM PIC.
Attachment #464271 -
Flags: review?(dvander)
|
||
Updated•14 years ago
|
Attachment #464271 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 3•14 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
||
Comment 4•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug585341.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•