Closed Bug 457456 Opened 13 years ago Closed 13 years ago

TM: "Assertion failed: cond->isCond()" with "if(true <= true)"

Categories

(Core :: JavaScript Engine, defect, P1)

x86
macOS
defect

Tracking

()

VERIFIED FIXED
mozilla1.9.1b1

People

(Reporter: jruderman, Assigned: gal)

Details

(Keywords: assertion, testcase, verified1.9.1)

Attachments

(1 file)

$ ~/tracemonkey/js/src/Darwin_DBG.OBJ/js -j
js> for (var j = 0; j < 3; ++j) { if(true <= true) { } }

Assertion failed: cond->isCond() (nanojit/Assembler.cpp:1228)
Assignee: general → gal
CC'ing graydon. We have to make sure nanojit2 also has these patches. The frontend relies on proper constant folding.
Flags: blocking1.9.1?
Priority: -- → P1
Target Milestone: --- → mozilla1.9.1b1
Attachment #340754 - Flags: review?(danderson) → review+
http://hg.mozilla.org/tracemonkey/rev/d2e1766c65b2
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
this still occurs on mozilla-central. when will tm by synced with mc?
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-457456.js,v  <--  regress-457456.js
initial revision: 1.1

http://hg.mozilla.org/mozilla-central/rev/b04c04268a94
Flags: in-testsuite+
Flags: in-litmus-
v 1.9.1 mozilla-central and tracemonkey
Status: RESOLVED → VERIFIED
Flags: blocking1.9.1? → blocking1.9.1+
Keywords: fixed1.9.1
Keywords: verified1.9.1
Keywords: fixed1.9.1
You need to log in before you can comment on or make changes to this bug.