Closed Bug 617450 Opened 13 years ago Closed 13 years ago

TypeInference: Assertion failure: backing->isType(JSVAL_TYPE_INT32)

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jandem, Assigned: bhackett1024)

References

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 file)

fix
1.96 KB, patch
Details | Diff | Splinter Review 
----
function f() {
    var x = 1.23;
    function g() {
        var y = x++;
    }
    g();
}
f();
----
Assertion failure: backing->isType(JSVAL_TYPE_INT32), at ../methodjit/FrameState.cpp:2104
Attached patch fix — — Splinter Review 
More robust handling when an entry whose type the Compiler doesn't know is stored to a known double.  (Eventually this sort of things shouldn't be possible, but it can still happen due to fused opcodes).

http://hg.mozilla.org/projects/jaegermonkey/rev/eee3770cab7f
Assignee: general → bhackett1024
Whiteboard: fixed-in-jaegermonkey
Blocks: infer-regress
No longer blocks: TypeInference
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.