Closed
Bug 700211
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: ins->type() == MIRType_Value, during pushTypeBarrier().
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: sstangl, Assigned: nbp)
References
Details
Attachments
(2 files)
209 bytes,
application/javascript
|
Details | |
1.77 KB,
patch
|
sstangl
:
review+
|
Details | Diff | Splinter Review |
This error is tripping frequently in the OSR branch, but can be reproduced on master with the attached test case. The IonBuilder is attempting to create an MUnbox instruction to act on MLoadSlots, which is Type_Int32. Test case must be run with "--ion -n" to reproduce.
Assignee | ||
Updated•13 years ago
|
Assignee: general → nicolas.b.pierron
Assignee | ||
Comment 1•13 years ago
|
||
Attachment #572861 -
Flags: review?(sstangl)
Reporter | ||
Updated•13 years ago
|
Attachment #572861 -
Flags: review?(sstangl) → review+
Reporter | ||
Comment 2•13 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/88f65dfb4831
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•