725062 - IonMonkey: Assertion failure: a.isFloatReg(), at ion/shared/CodeGenerator-shared-inl.h:81

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on ionmonkey revision c34398f961e7 (run with --ion -n -m), tested on 64 bit:


function rec(x, self) {
    if (a = parseLegacyJSON("[1 , ]").length)
        self(x - 001 , self);
    self(NaN, self);
}
rec(1, rec);

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/e8055203d13e

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug725062.js.