Closed
Bug 724530
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: unexpected type, at ion/Lowering.cpp:626
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(1 file)
|
1.27 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
Another assert found while reducing a modified SS fannkuch.
Blocking bug 724444 to avoid duplicates.
|
Assignee | |
Comment 1•13 years ago
|
||
If a binary op has int32 result type but one of its operands is |undefined|, we don't want to specialize as int32 since ToNumber(undefined) is NaN. The result will likely be a double (NaN) anyway so just let the stub trigger invalidation.
The alternative is to accept only int32 or double types, but I'd rather not do that: (poorly written) benchmarks/scripts may use int32 + bool or something and ToInt32 can handle that just fine.
Attachment #594695 -
Flags: review?(dvander)
|
||
Updated•13 years ago
|
Attachment #594695 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 2•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•