Last Comment Bug 705251 - IonMonkey: "Assertion failure: isLowered()"
: IonMonkey: "Assertion failure: isLowered()"
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
-- normal (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: IonMonkey
  Show dependency treegraph
Reported: 2011-11-25 03:52 PST by Jan de Mooij [:jandem]
Modified: 2011-11-28 00:42 PST (History)
0 users
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Fix (1.28 KB, patch)
2011-11-25 05:00 PST, Jan de Mooij [:jandem]
no flags Details | Diff | Splinter Review
Fix (1.37 KB, patch)
2011-11-25 05:05 PST, Jan de Mooij [:jandem]
cdleary: review+
Details | Diff | Splinter Review

Description User image Jan de Mooij [:jandem] 2011-11-25 03:52:29 PST
A modified version of bitops-bits-in-byte asserts with

Assertion failure: isLowered(), at ion/MIR.h:408
Comment 1 User image Jan de Mooij [:jandem] 2011-11-25 05:00:20 PST
Created attachment 576906 [details] [diff] [review]

The problem was that we removed MPassArg for |this|, but didn't unwrap it in inheritUnwrapArgs. Also fixes ion/inlining/inline-callarg-bailout.js
Comment 2 User image Jan de Mooij [:jandem] 2011-11-25 05:05:53 PST
Created attachment 576907 [details] [diff] [review]

The right version this time.
Comment 3 User image Jan de Mooij [:jandem] 2011-11-28 00:42:12 PST

Note You need to log in before you can comment on or make changes to this bug.