Closed
Bug 678653
Opened 14 years ago
Closed 13 years ago
IonMonkey: Assertion failure: regs.sp == regs.fp()->base(), at jsinterp.cpp:2390
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: adrake, Unassigned)
References
Details
Attachments
(1 file)
|
190 bytes,
application/javascript
|
Details |
Attached test case asserts from within bailout on ionmonkey x86 debug.
|
Reporter | |
Comment 1•14 years ago
|
||
(You need the double patches for lsra landed/applied)
|
|
Reporter | |
Comment 2•14 years ago
|
||
Just updated to tip, now this assert happens with the greedy allocator enabled, too.
This was fixed by bug 677339, unclear how but it fixed some bugs in type analysis.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•