Closed
Bug 688968
Opened 13 years ago
Closed 13 years ago
Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:179
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla10
People
(Reporter: decoder, Assigned: bhackett1024)
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
1.63 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The following test asserts on mozilla-central revision fecae145d884 (options -m -n -a):
function foo(x) {
x === x--;
}
foo(1.2);
|
Assignee | |
Comment 1•13 years ago
|
||
Bogus assert. There's a special path we take when code like 'x === x' shows up to test for NaN. It needs normal registers, and if the entry is a known double we forget that so we can get the registers (probably generating some pretty bad code; this path hasn't been updated for TI). The botch happens when we forget the lhs is a double, the fix pops the rhs first (it is no longer needed) so the lhs is not copied.
Assignee: general → bhackett1024
Attachment #563800 -
Flags: review?(dvander)
|
|
Assignee | |
Updated•13 years ago
|
Whiteboard: js-triage-needed
|
||
Updated•13 years ago
|
Attachment #563800 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 2•13 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/db349edef0d6
|
||
Comment 3•13 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/db349edef0d6
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla10
|
Reporter | |
Comment 4•11 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•