Closed
Bug 459085
Opened 18 years ago
Closed 18 years ago
TM: Number.toString traceable native is broken
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: jorendorff, Assigned: jorendorff)
References
Details
Attachments
(1 file)
|
3.61 KB,
patch
|
gal
:
review+
|
Details | Diff | Splinter Review |
The knownNative entry has "TC" but the native expects a jsdouble argument. So
m = new Number(3)
function foo() { for (i=0; i<20;i++) m.toString(); }
foo()
Assertion failed: "Should not move data from GPR to XMM": false (nanojit/Nativei386.cpp:1185)
Trace/BPT trap
Patch later today if nobody beats me to it.
|
Assignee | |
Comment 1•18 years ago
|
||
Assignee: general → jorendorff
Attachment #342305 -
Flags: review?
|
|
Assignee | |
Updated•18 years ago
|
Attachment #342305 -
Flags: review? → review?(gal)
|
|
||
Updated•18 years ago
|
Attachment #342305 -
Flags: review?(gal) → review+
|
|
Assignee | |
Comment 2•18 years ago
|
||
This patch applies on top of the one in bug 458735.
Depends on: 458735
|
|
Assignee | |
Comment 3•18 years ago
|
||
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
|
||
Comment 4•18 years ago
|
||
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-459085.js,v <-- regress-459085.js
initial revision: 1.1
http://hg.mozilla.org/mozilla-central/rev/b04c04268a94
Flags: in-testsuite+
Flags: in-litmus-
You need to log in
before you can comment on or make changes to this bug.
Description
•