Closed Bug 617624 Opened 10 years ago Closed 10 years ago

TypeInference: Assertion failure: !fe->isType(JSVAL_TYPE_DOUBLE)

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: bhackett1024)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

---
function f() {
    var x;
    var a = x;
    Boolean(a = Number(12.34));
}
f();
---
Assertion failure: !fe->isType(JSVAL_TYPE_DOUBLE), at ../methodjit/FrameState-inl.h:751
Attached patch fixSplinter Review
Another FP register bug in FrameState::storeTop (yeesh).

http://hg.mozilla.org/projects/jaegermonkey/rev/fcc727676be6
Assignee: general → bhackett1024
Blocks: infer-regress
No longer blocks: TypeInference
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.