Closed Bug 639567 Opened 13 years ago Closed 13 years ago

TI+JM: Assertion failure: !fe->type.isConstant(), at ../methodjit/FrameState-inl.h:447

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

Details

(Whiteboard: fixed-in-jaegermonkey)

--
function f(o) {
    o == 1;
    if (o == 2) {}
}
f(3.14);
--
$ ./js -a -m -n test.js
Assertion failure: !fe->type.isConstant(), at ../methodjit/FrameState-inl.h:447
fixDoubleTypes (used to make sure non-escaping int|float locals/args are in fact doubles) did not preserve the invariant that frame entries which are copies have the same type as the copied entry.

http://hg.mozilla.org/projects/jaegermonkey/rev/0edb03210dac
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
You need to log in before you can comment on or make changes to this bug.