617450 - TypeInference: Assertion failure: backing->isType(JSVAL_TYPE_INT32)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

----
function f() {
    var x = 1.23;
    function g() {
        var y = x++;
    }
    g();
}
f();
----
Assertion failure: backing->isType(JSVAL_TYPE_INT32), at ../methodjit/FrameState.cpp:2104

Comment 1

[Brian Hackett [Laid off!]]

Attachment: fix

More robust handling when an entry whose type the Compiler doesn't know is stored to a known double.  (Eventually this sort of things shouldn't be possible, but it can still happen due to fused opcodes).

http://hg.mozilla.org/projects/jaegermonkey/rev/eee3770cab7f