TypeInference: Assertion failure: backing->isType(JSVAL_TYPE_INT32)

RESOLVED FIXED

Status

()

defect
RESOLVED FIXED
9 years ago
9 years ago

People

(Reporter: jandem, Assigned: bhackett)

Tracking

(Blocks 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 attachment)

----
function f() {
    var x = 1.23;
    function g() {
        var y = x++;
    }
    g();
}
f();
----
Assertion failure: backing->isType(JSVAL_TYPE_INT32), at ../methodjit/FrameState.cpp:2104
Posted patch fixSplinter Review
More robust handling when an entry whose type the Compiler doesn't know is stored to a known double.  (Eventually this sort of things shouldn't be possible, but it can still happen due to fused opcodes).

http://hg.mozilla.org/projects/jaegermonkey/rev/eee3770cab7f
Assignee: general → bhackett1024
Whiteboard: fixed-in-jaegermonkey
Blocks: infer-regress
No longer blocks: TypeInference
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.