645657 - TI+JM: Assertion failure: type == JSVAL_TYPE_DOUBLE, at ../methodjit/FrameState.cpp:2460

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f() {
    var x = 3;
    var y = 1.2;
    var z;
    y = --z;
    x = z++;
}
f();
--
$ ./js -n -a -m test.js
Assertion failure: type == JSVAL_TYPE_DOUBLE, at ../methodjit/FrameState.cpp:2460

Comment 1

[Brian Hackett [Laid off!]]

We could mark a variable inferred to be an integer as a copy of a double.  The compiler should tolerate this, though I'm not sure it's possible in non-doomed code (the accesses to z will trigger recompilation once they occur).

http://hg.mozilla.org/projects/jaegermonkey/rev/842d95ddaec5