Closed
Bug 914127
Opened 11 years ago
Closed 11 years ago
Assertion failure: IsCallPC(pc), at jit/IonFrames.cpp:1475
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 913978
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
(deleted),
text/plain
|
Details |
The following testcase asserts on mozilla-central revision c7cc85e13f7a (run with --fuzzing-safe --ion-eager):
index = 0;
for (j = 0; j <= 1; ++j)
def({get: Function("return "+index+";")});
function def(descriptor_seed) {
var var_name = "x" + index;
descriptor_seed.enumerable = !!j;
Object.defineProperty(Object.prototype, var_name, descriptor_seed);
++index;
}
function testDontEnum(F) {
var proto = F.prototype;
for (var prop in F)
if (F[prop] === proto)
return false;
}
testDontEnum(Error);
testDontEnum(URIError);
|
Reporter | |
Comment 1•11 years ago
|
||
|
||
Comment 2•11 years ago
|
||
Related to bug 913978?
|
||
Comment 3•11 years ago
|
||
(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #2)
> Related to bug 913978?
Yeah, dup.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•