Closed
Bug 847425
Opened 11 years ago
Closed 11 years ago
BaselineCompiler: Assertion failure: type == MIRType_Boolean || type == MIRType_Int32 || type == MIRType_Double || type == MIRType_String || type == MIRType_Object, at ion/MIR.h:1767 with OOM
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: jandem)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update])
Attachments
(1 file)
1.52 KB,
patch
|
djvj
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on baseline compiler branch revision a956beaa9efd (run with --ion-eager): gcparam("maxBytes", gcparam("gcBytes") + 4*1024); var max = 400; function f(b) { if (b) { f(b - 1); } else { g = { apply:function(x,y) { } }; } g.apply(null, arguments); } f(max - 1);
Assignee | ||
Comment 1•11 years ago
|
||
We have to check the result of GuardFunApplyArgumentsOptimization since it's fallible.
Updated•11 years ago
|
Attachment #723908 -
Flags: review?(kvijayan) → review+
Assignee | ||
Comment 2•11 years ago
|
||
https://hg.mozilla.org/projects/ionmonkey/rev/c0197fba12c9
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•