Closed
Bug 617450
Opened 13 years ago
Closed 13 years ago
TypeInference: Assertion failure: backing->isType(JSVAL_TYPE_INT32)
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Assigned: bhackett1024)
References
Details
(Whiteboard: fixed-in-jaegermonkey)
Attachments
(1 file)
1.96 KB,
patch
|
Details | Diff | Splinter Review |
---- function f() { var x = 1.23; function g() { var y = x++; } g(); } f(); ---- Assertion failure: backing->isType(JSVAL_TYPE_INT32), at ../methodjit/FrameState.cpp:2104
Assignee | ||
Comment 1•13 years ago
|
||
More robust handling when an entry whose type the Compiler doesn't know is stored to a known double. (Eventually this sort of things shouldn't be possible, but it can still happen due to fused opcodes). http://hg.mozilla.org/projects/jaegermonkey/rev/eee3770cab7f
Assignee: general → bhackett1024
Assignee | ||
Updated•13 years ago
|
Whiteboard: fixed-in-jaegermonkey
![]() |
||
Updated•13 years ago
|
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•