Closed
Bug 809468
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: inst->is<InstCMP>(), at ion/arm/Assembler-arm.cpp:2409
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 808067
People
(Reporter: decoder, Assigned: mjrosenb)
References
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:ignore])
The following testcase asserts on mozilla-central revision 98b004c70db0 (run with --ion-eager):
var BUGNUMBER = '';
function printBugNumber (num) {
BUGNUMBER = num;
}
function test() {
printBugNumber(BUGNUMBER);
}
gcslice(0);
gcslice(1);
gcslice();
[""][test() !== "ok"] = (null);
gczeal(4);
|
Reporter | |
Comment 1•12 years ago
|
||
S-s due to GC-relatedness.
Assignee: general → mrosenberg
Whiteboard: [jsbugmon:ignore]
|
||
Comment 2•12 years ago
|
||
Have you had a chance to look at this, Marty?
|
Assignee | |
Comment 3•12 years ago
|
||
Noticed that this no longer reproduced, ran hg bisect on it, and it pointed to this commit:
The first bad revision is:
changeset: 112669:bdd3bfd15630
user: Bill McCloskey <wmccloskey@mozilla.com>
date: Wed Nov 07 10:30:30 2012 -0800
summary: Bug 808067 - Fix needsBarrier for GC (r=sstangl,jonco)
This seems to be the same bug, so closing
also, fwiw, while tracking this down, I noticed that the revision listed in the description doesn't actually exist in m-c, so that may indicate a problem.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
|
||
Updated•9 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•