Closed
Bug 792231
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: [barrier verifier] Unmarked edge: element, at jsgc.cpp:5406
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 792239
| Tracking | Status | |
|---|---|---|
| firefox17 | --- | unaffected |
| firefox18 | + | fixed |
| firefox-esr10 | --- | unaffected |
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, sec-high, testcase, Whiteboard: [ion:p1:fx18][sg:dupe 792239])
The following testcase asserts on mozilla-central revision e4757379b99a (run with --ion-eager):
gczeal(4);
function testmath(funcname, args, expected) {
var actuals = []
var mapfunc = eval(
"(function(a) {\n"
+ " for (var i = 0; i < a.length; i++)\n"
+ " a[i] = " + funcname + "(" + actuals +");\n"
+ " })\n"
);
var dummies_and_input = [];
for (i = 0; i < 9; i++) {
var dummy_list = [];
dummies_and_input[i] = dummy_list;
}
mapfunc(dummies_and_input);
}
testmath("Infinity/Math.tan", "-0", -Infinity)
|
||
Updated•12 years ago
|
Summary: Assertion failure: [barrier verifier] Unmarked edge: element, at jsgc.cpp:5406 → IonMonkey: Assertion failure: [barrier verifier] Unmarked edge: element, at jsgc.cpp:5406
Whiteboard: [ion:p1:fx18]
|
Reporter | |
Comment 1•12 years ago
|
||
ARM only, cc'ing Marty.
|
||
Updated•12 years ago
|
status-firefox-esr10:
--- → unaffected
status-firefox17:
--- → unaffected
status-firefox18:
--- → affected
tracking-firefox18:
--- → +
|
||
Comment 2•12 years ago
|
||
hg bisect pointed to the commit for this bug, and the bug itself seems decently similar.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
|
||
Updated•12 years ago
|
|
|
||
Updated•12 years ago
|
Group: core-security
Whiteboard: [ion:p1:fx18] → [ion:p1:fx18][sg:dupe 792239]
|
|
Reporter | |
Comment 3•12 years ago
|
||
Bug 792239 has the smaller test, marking in-testsuite-.
Flags: in-testsuite-
You need to log in
before you can comment on or make changes to this bug.
Description
•