Closed Bug 777647 Opened 12 years ago Closed 12 years ago

IonMonkey: Four jit-tests assert: !hasLazyType()

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: dvander, Assigned: jandem)

References

Details

Attachments

(1 file)

This assert is firing on four tests, that can be found by running jit-tests with --ion. One of the tests is testCallApply (I can't see the others right now since TBPL is down).

This is most likely a regression from the TI patch that fixed v8-raytrace, which we took in a recent merge.
This will also fix the crash on Mochitest column 1 seen only in debug builds.
Attached patch PatchSplinter Review
If UseNewTypeForClone is true, we have to give the clone a singleton type and clone the script, we don't want the fast path to handle these cases.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #646071 - Flags: review?(dvander)
Attachment #646071 - Flags: review?(dvander) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/1274d6819bae
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.