Closed
Bug 912152
Opened 11 years ago
Closed 11 years ago
Assertion failure: !script()->analysis()->hasTryFinally(), at jit/IonBuilder.cpp
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla26
People
(Reporter: gkw, Assigned: bhackett1024)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])
Attachments
(3 files)
((function() {
try {
new(arguments.callee);
} finally {}
})());
asserts js debug shell on m-c changeset 7ff96bd19c1c without any CLI arguments at Assertion failure: !script()->analysis()->hasTryFinally(), at jit/IonBuilder.cpp
My configure flags are:
--target=x86_64-apple-darwin11.4.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
changeset: http://hg.mozilla.org/mozilla-central/rev/abb25a18b5a5
user: Brian Hackett
date: Mon Sep 02 10:05:27 2013 -0700
summary: Bug 906788 - Construct TypeObject newScript information using MIR, r=jandem.
Brian, is bug 906788 a possible regressor?
Flags: needinfo?(bhackett1024)
|
||
Comment 1•11 years ago
|
||
|
Assignee | |
Comment 2•11 years ago
|
||
IonBuilder wanted its callers to check the script did not contain try-finally, which happened in IonCompile but not the definite properties analysis. This moves the check to IonBuilder itself to avoid the fragility.
Assignee: general → bhackett1024
Attachment #801662 -
Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
|
||
Updated•11 years ago
|
Attachment #801662 -
Flags: review?(jdemooij) → review+
|
|
Assignee | |
Comment 3•11 years ago
|
||
|
||
Comment 4•11 years ago
|
||
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
You need to log in
before you can comment on or make changes to this bug.
Description
•