Closed Bug 642758 Opened 9 years ago Closed 9 years ago

TI: Assertion failure: op == JSOP_DIV, at ./methodjit/FastArithmetic.cpp:381

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase, Whiteboard: fixed-in-jaegermonkey)

The following test case (run with -n -a -m) asserts on TI tip, tested on 64
bit:

function Integer( value, exception ) { }
new Integer( Math.LN2, ++INVALID_INTEGER_VALUE? exception+1.1: 1900 );
Bogus assert.  The result of a non-division addition on a double can be inferred as int if no types at all were inferred for the other side of the addition (so that we will end up recompiling before the code can run).

http://hg.mozilla.org/projects/jaegermonkey/rev/332d7b94dc35
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
Blocks: 676763
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug642758.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.