If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

IonMonkey: Assertion failure: unexpected type, at js/src/ion/LIR.h:568

RESOLVED DUPLICATE of bug 742606

Status

()

Core
JavaScript Engine
--
major
RESOLVED DUPLICATE of bug 742606
6 years ago
6 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Other Branch
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:update])

(Reporter)

Description

6 years ago
The following testcase asserts on ionmonkey revision a9a18824b4c1 (run with --ion -n -m --ion-eager):


var callStack = new Array();
var lastFunc = callStack.pop();
var i = 100; while (i > 0) { i--; }

Comment 1

6 years ago
The first bad revision is:
changeset:   cdc5f3570a4c
user:        Jan de Mooij
date:        Tue Apr 03 09:26:15 2012 +0200
summary:     Bug 739572 part 1 - Inline array.pop and array.shift. r=dvander
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 742606
You need to log in before you can comment on or make changes to this bug.