Last Comment Bug 725062 - IonMonkey: Assertion failure: a.isFloatReg(), at ion/shared/CodeGenerator-shared-inl.h:81
: IonMonkey: Assertion failure: a.isFloatReg(), at ion/shared/CodeGenerator-sha...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- major (vote)
: ---
Assigned To: David Anderson [:dvander]
:
:
Mentors:
Depends on:
Blocks: langfuzz IonFuzz
  Show dependency treegraph
 
Reported: 2012-02-07 13:04 PST by Christian Holler (:decoder)
Modified: 2013-01-14 08:01 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (1.22 KB, patch)
2012-02-08 12:24 PST, David Anderson [:dvander]
sstangl: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-02-07 13:04:25 PST
The following testcase asserts on ionmonkey revision c34398f961e7 (run with --ion -n -m), tested on 64 bit:


function rec(x, self) {
    if (a = parseLegacyJSON("[1 , ]").length)
        self(x - 001 , self);
    self(NaN, self);
}
rec(1, rec);
Comment 1 David Anderson [:dvander] 2012-02-08 12:24:32 PST
Created attachment 595489 [details] [diff] [review]
fix
Comment 2 David Anderson [:dvander] 2012-02-08 14:38:39 PST
http://hg.mozilla.org/projects/ionmonkey/rev/e8055203d13e
Comment 3 Christian Holler (:decoder) 2013-01-14 08:01:32 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug725062.js.

Note You need to log in before you can comment on or make changes to this bug.