Closed
Bug 762457
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: token , at ion/shared/IonFrames-x86-shared.cpp:59 or Crash [@ js::ion::IonCode::raw]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 762547
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,ignore])
The following testcase asserts on ionmonkey revision 8acbac4d6cfd (run with --ion -n -m --ion-eager):
gcPreserveCode()
function f() {
function g() {
for (var i = 0; i < 5; ++i) {
try { f(); } catch(e) {}
}
}
function h() { }
g();
h();
}
f();
|
Reporter | |
Comment 1•12 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision d64bb62ab69c).
|
|
Reporter | |
Updated•12 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
|
||
Comment 2•12 years ago
|
||
Appears to be fixed (loops forever). Variations that do not loop forever pass.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
|
||
Updated•11 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•