Closed
Bug 732856
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: isObject(), at ../../jsapi.h:543
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: test [jsbugmon:update,close,ignore])
The following testcase asserts on ionmonkey revision 1fd6c40d3852 (run with --ion -n):
var cnName = 'name';
var cnNameGetter = function() {this.nameGETS++; return this._name;};
obj = (new (function ( ) { } ) );
obj.__defineGetter__(cnName, cnNameGetter);
function lameFunc(x, y) {
var lsw = (x & 0xFFFF) + (y & 0xFFFF);
var msw = (obj.name) + (y >> 16) + (lsw >> 16);
}
function runSomeTimes(func, iters) {
for (var i = 0; i < iters; ++i) {
result = func(42, 42);
}
}
for (var i = 0; i < 11000; ++i)
runSomeTimes(lameFunc, 1);
|
Reporter | |
Updated•13 years ago
|
Whiteboard: test [jsbugmon:update,close]
|
|
Reporter | |
Comment 1•13 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision fe58c6671ebd).
|
|
Reporter | |
Updated•13 years ago
|
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
Whiteboard: test [jsbugmon:update,close] → test [jsbugmon:update,close,ignore]
|
||
Comment 2•13 years ago
|
||
~/fuzzing/autoBisectJs/autoBisect.py -p -a64 -s 1fd6c40d3852 -e default -d ~/trees/ionmonkey/ --flags="--ion,-n" ~/Desktop/r.js
The first good revision is:
changeset: fed610aff637
user: Nicolas Pierron
date: Fri Mar 23 01:06:14 2012 -0700
summary: Mark inlined boxed JSFunction as constant. (Bug 729899, r=dvander)
|
|
Reporter | |
Comment 3•12 years ago
|
||
Automatically extracted testcase for this bug was committed:
https://hg.mozilla.org/mozilla-central/rev/2e891e0db397
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•