Closed Bug 617670 Opened 10 years ago Closed 10 years ago

TypeInference: Assertion failure: op == JSOP_DIV

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: bhackett1024)

References

(Blocks 1 open bug)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 file)

---
var y = -null - y;
assertEq(y, NaN);
---
Assertion failure: op == JSOP_DIV, at ../methodjit/FastArithmetic.cpp:389
Attached patch fixSplinter Review
This fixes the Compiler to abort and retry in case of static overflow, instead of skipping the fold and proceeding as normal.  This approach is still kind of lame; the best thing to do is get the emitter to do constant and copy propagation.

http://hg.mozilla.org/projects/jaegermonkey/rev/c247104a1499
Assignee: general → bhackett1024
Whiteboard: fixed-in-jaegermonkey
Blocks: 617712
Blocks: 617688
Blocks: infer-regress
No longer blocks: TypeInference, 617688, 617712
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.