The default bug view has changed. See this FAQ.

IonMonkey: Four jit-tests assert: !hasLazyType()

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: dvander, Assigned: jandem)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
This assert is firing on four tests, that can be found by running jit-tests with --ion. One of the tests is testCallApply (I can't see the others right now since TBPL is down).

This is most likely a regression from the TI patch that fixed v8-raytrace, which we took in a recent merge.
(Reporter)

Comment 1

5 years ago
This will also fix the crash on Mochitest column 1 seen only in debug builds.
(Assignee)

Comment 2

5 years ago
Created attachment 646071 [details] [diff] [review]
Patch

If UseNewTypeForClone is true, we have to give the clone a singleton type and clone the script, we don't want the fast path to handle these cases.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #646071 - Flags: review?(dvander)
(Reporter)

Updated

5 years ago
Attachment #646071 - Flags: review?(dvander) → review+
(Reporter)

Comment 3

5 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/1274d6819bae
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.