Closed
Bug 695902
Opened 13 years ago
Closed 13 years ago
IonMonkey: "Assertion failure: ins->type() == MIRType_Value,"
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
4.31 KB,
text/plain
|
Details |
o = []
function f() {
o
}
new f
f()
asserts js debug shell on IM changeset 7a002b39d8be with -m, -n and --ion-eager at Assertion failure: ins->type() == MIRType_Value,
|
Reporter | |
Comment 1•13 years ago
|
||
No longer reproduces, possibly fixed by bug 700211. autoBisect shows this is probably related to the following changeset: The first good revision is: changeset: 80422:88f65dfb4831 user: Nicolas Pierron date: Thu Nov 10 19:49:37 2011 -0800 summary: Do not add type barrier if instruction has expected type. (Bug 700211, r=sstangl)
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
|
|
Reporter | |
Updated•12 years ago
|
Blocks: IonFuzz
Summary: IM: "Assertion failure: ins->type() == MIRType_Value," → IonMonkey: "Assertion failure: ins->type() == MIRType_Value,"
You need to log in
before you can comment on or make changes to this bug.
Description
•