Closed
Bug 725000
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: input->type() == MIRType_Int32, at ion/Lowering.cpp:354
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: dvander)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
17.72 KB,
patch
|
sstangl
:
review+
|
Details | Diff | Splinter Review |
The following testcase asserts on ionmonkey revision c34398f961e7 (run with --ion -n), tested on 64 bit: function printBugNumber (num) {} (function(){for(j=02 ;j<3;~ printBugNumber)NaN=42})();
Assignee | ||
Comment 1•12 years ago
|
||
We needed an unspecialized version of BitNot.
Assignee | ||
Updated•12 years ago
|
Attachment #595573 -
Flags: review? → review?(sstangl)
Comment 2•12 years ago
|
||
Comment on attachment 595573 [details] [diff] [review] fix Review of attachment 595573 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/arm/Trampoline-arm.cpp @@ +591,2 @@ > outReg = regs.takeAny(); > + masm.reserveStack(sizeof(int)); for consistency with freeStack() below, |int32|? ::: js/src/ion/x64/Trampoline-x64.cpp @@ +517,2 @@ > outReg = regs.takeAny(); > + masm.reserveStack(sizeof(int)); int32? @@ +596,2 @@ > masm.load32(Address(esp, 0), ReturnReg); > + masm.freeStack(sizeof(int)); int32?
Attachment #595573 -
Flags: review?(sstangl) → review+
Assignee | ||
Comment 3•12 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/1ae79ea16a74 Nits pushed in a follow-up fix.
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 4•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug725000.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•