Closed Bug 617450 Opened 10 years ago Closed 10 years ago

TypeInference: Assertion failure: backing->isType(JSVAL_TYPE_INT32)

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: bhackett1024)

References

(Blocks 1 open bug)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 file)

----
function f() {
    var x = 1.23;
    function g() {
        var y = x++;
    }
    g();
}
f();
----
Assertion failure: backing->isType(JSVAL_TYPE_INT32), at ../methodjit/FrameState.cpp:2104
Attached patch fixSplinter Review
More robust handling when an entry whose type the Compiler doesn't know is stored to a known double.  (Eventually this sort of things shouldn't be possible, but it can still happen due to fused opcodes).

http://hg.mozilla.org/projects/jaegermonkey/rev/eee3770cab7f
Assignee: general → bhackett1024
Whiteboard: fixed-in-jaegermonkey
Blocks: infer-regress
No longer blocks: TypeInference
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.