Closed
Bug 732851
Opened 12 years ago
Closed 12 years ago
IonMonkey: Assertion failure: (objBits >> 47) == 0, at ../../jsval.h:782
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase)
The following testcase asserts on ionmonkey revision 1fd6c40d3852 (run with --ion -n -m --ion-eager): var OMIT = {}; var WRITABLES = [true, false, OMIT]; { var desc = {}; function put(field, value) desc[field] = value; WRITABLES.forEach(function(writable) { put("writable", writable) }); };
This is a bogus assert that is unfortunately really painful to work around. I added to the paper-over logic. I have plans to address this but it's best to wait for the scope work to finish. http://hg.mozilla.org/projects/ionmonkey/rev/6c52f57ea5ee
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Reporter | ||
Comment 2•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug732851.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•