Closed Bug 465236 Opened 17 years ago Closed 17 years ago

"Assertion failure: we should have converted to numbers already" with (null <= null)

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: jruderman, Unassigned)

References

Details

(4 keywords)

js> for (let j = 0; j < 2; ++j) null <= null; Assertion failure: we should have converted to numbers already, at ../jstracer.cpp:4541
Blocks: arithfuzz
Flags: blocking1.9.1+
This is "fixed", to a certain extent, by the patch in bug 465255. It would be better if that bug actually performed the null <= null comparison, but at least it manages to abort the trace rather than fault.
Depends on: 465255
A response to comment 1 is in bug 465255 comment 9.
Fixed by the patch in bug 465255, which has already been pushed to mozilla-central :)
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
http://hg.mozilla.org/mozilla-central/rev/99c89d7b7b31 /cvsroot/mozilla/js/tests/js1_7/regress/regress-465236.js,v <-- regress-465236.js initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-
v 1.9.1, 1.9.2
Status: RESOLVED → VERIFIED
Keywords: fixed1.9.1 → verified1.9.1
You need to log in before you can comment on or make changes to this bug.