Closed
Bug 801325
Opened 12 years ago
Closed 12 years ago
Assertion failure: self->nativeContainsNoAllocation(*aprop), at jsscope.cpp:859
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 824217
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update,ignore])
The following testcase asserts on mozilla-central revision 90857937b601 (run with --ion-eager):
a = evalcx("lazy");
a["Object"] = this;
typeof a.isPrototypeOf == ("h e l l o")
a.x = 0X2A;
delete a.x;
|
||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisect]
|
Reporter | |
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:update]
|
|
Reporter | |
Comment 1•12 years ago
|
||
JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: 107534:adab1fdcfe0a
user: Luke Wagner
date: Tue Sep 04 14:31:04 2012 -0700
summary: Bug 786801 - js_InferFlags should not stop at compartment boundaries (r=bhackett)
This iteration took 101.292 seconds to run.
|
|
||
Comment 2•12 years ago
|
||
Luke, autoBisect points to bug 786801 - will it be possible to take a look?
Blocks: 786801
status-firefox-esr10:
--- → unaffected
status-firefox16:
--- → unaffected
status-firefox17:
--- → unaffected
status-firefox18:
--- → affected
status-firefox19:
--- → affected
status-firefox-esr17:
--- → unaffected
Keywords: regression
|
|
||
Comment 3•12 years ago
|
||
16 and 17 should also be affected because that fix landed in beta when it was still 16 as well, adjusting flags accordingly.
|
|
Reporter | |
Updated•12 years ago
|
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
|
|
Reporter | |
Comment 4•12 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 4e18ac9b51e2).
|
|
||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,ignore] → [jsbugmon:update,ignore,bisectfix]
|
|
||
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,ignore,bisectfix] → [jsbugmon:update,bisectfix]
|
|
Reporter | |
Updated•12 years ago
|
Whiteboard: [jsbugmon:update,bisectfix] → [jsbugmon:update,ignore]
|
|
Reporter | |
Comment 5•12 years ago
|
||
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 4e18ac9b51e2).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:
The first good revision is:
changeset: 117329:0ce29ce2ea7c
user: Jeff Walden
date: Wed Dec 19 19:32:34 2012 -0500
summary: Bug 824217 - Remove some easy-to-remove tests of JSRESOLVE_ASSIGNING. r=bz
This iteration took 66.024 seconds to run.
|
|
Reporter | |
Comment 6•12 years ago
|
||
Waldo, did bug
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•