Closed
Bug 777647
Opened 12 years ago
Closed 12 years ago
IonMonkey: Four jit-tests assert: !hasLazyType()
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: dvander, Assigned: jandem)
References
Details
Attachments
(1 file)
|
1.21 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
This assert is firing on four tests, that can be found by running jit-tests with --ion. One of the tests is testCallApply (I can't see the others right now since TBPL is down).
This is most likely a regression from the TI patch that fixed v8-raytrace, which we took in a recent merge.
|
Reporter | |
Comment 1•12 years ago
|
||
This will also fix the crash on Mochitest column 1 seen only in debug builds.
|
Assignee | |
Comment 2•12 years ago
|
||
If UseNewTypeForClone is true, we have to give the clone a singleton type and clone the script, we don't want the fast path to handle these cases.
|
|
Reporter | |
Updated•12 years ago
|
Attachment #646071 -
Flags: review?(dvander) → review+
|
|
Reporter | |
Comment 3•12 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•