Closed Bug 645657 Opened 13 years ago Closed 13 years ago

TI+JM: Assertion failure: type == JSVAL_TYPE_DOUBLE, at ../methodjit/FrameState.cpp:2460

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

Details

--
function f() {
    var x = 3;
    var y = 1.2;
    var z;
    y = --z;
    x = z++;
}
f();
--
$ ./js -n -a -m test.js
Assertion failure: type == JSVAL_TYPE_DOUBLE, at ../methodjit/FrameState.cpp:2460
We could mark a variable inferred to be an integer as a copy of a double.  The compiler should tolerate this, though I'm not sure it's possible in non-doomed code (the accesses to z will trigger recompilation once they occur).

http://hg.mozilla.org/projects/jaegermonkey/rev/842d95ddaec5
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.