Closed
Bug 1077041
Opened 10 years ago
Closed 10 years ago
Scalar replacement: JSObject::copy, Assertion failure: numFixed <= span
Categories
(Core :: JavaScript Engine: JIT, defect)
Core
JavaScript Engine: JIT
Tracking
()
RESOLVED
FIXED
mozilla35
People
(Reporter: nbp, Assigned: nbp)
References
Details
Attachments
(1 file)
No description provided.
Assignee | ||
Comment 1•10 years ago
|
||
This assertion compares the overall allocation of fixed slots + dynamic slots, with the number of allocated fixed slots. The span can actually be smaller than the number of fixed slots. This triggers with scalar replacement, when running the test --ion-offthread-compile=off v8-v5/check-raytrace.js
Attachment #8499079 -
Flags: review?(jdemooij)
Updated•10 years ago
|
Attachment #8499079 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 2•10 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/43f525528c42
Comment 3•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/43f525528c42
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in
before you can comment on or make changes to this bug.
Description
•