Last Comment Bug 705251 - IonMonkey: "Assertion failure: isLowered()"
: IonMonkey: "Assertion failure: isLowered()"
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
:
Mentors:
Depends on:
Blocks: IonMonkey
  Show dependency treegraph
 
Reported: 2011-11-25 03:52 PST by Jan de Mooij [:jandem]
Modified: 2011-11-28 00:42 PST (History)
0 users
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Fix (1.28 KB, patch)
2011-11-25 05:00 PST, Jan de Mooij [:jandem]
no flags Details | Diff | Review
Fix (1.37 KB, patch)
2011-11-25 05:05 PST, Jan de Mooij [:jandem]
cdleary: review+
Details | Diff | Review

Description Jan de Mooij [:jandem] 2011-11-25 03:52:29 PST
A modified version of bitops-bits-in-byte asserts with

Assertion failure: isLowered(), at ion/MIR.h:408
Comment 1 Jan de Mooij [:jandem] 2011-11-25 05:00:20 PST
Created attachment 576906 [details] [diff] [review]
Fix

The problem was that we removed MPassArg for |this|, but didn't unwrap it in inheritUnwrapArgs. Also fixes ion/inlining/inline-callarg-bailout.js
Comment 2 Jan de Mooij [:jandem] 2011-11-25 05:05:53 PST
Created attachment 576907 [details] [diff] [review]
Fix

The right version this time.
Comment 3 Jan de Mooij [:jandem] 2011-11-28 00:42:12 PST
http://hg.mozilla.org/projects/ionmonkey/rev/f3068b10487b

Note You need to log in before you can comment on or make changes to this bug.