Closed Bug 647440 Opened 9 years ago Closed 9 years ago

TI+JM: Assertion failure: !isEntryCopied(fe), at ../methodjit/FrameState-inl.h:878

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

--
if (false) 
    function g() {}
function f() {
    var x;
    (x = Infinity) >> x--;
}
f();
--
$ ./js -m -n -a test.js
Assertion failure: !isEntryCopied(fe), at ../methodjit/FrameState-inl.h:878
When doing a bitwise op we need to make sure the operands are not copies of one another (they can both be copies of a third thing, but I didn't think it was possible that the rhs could directly copy the lhs).

http://hg.mozilla.org/projects/jaegermonkey/rev/74201cda4ce3
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.