Closed
Bug 785997
Opened 13 years ago
Closed 13 years ago
IonMonkey: Immediate crash on startup in jsanalyze.h:633
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 783008
People
(Reporter: sstangl, Unassigned)
References
Details
Attachments
(1 file)
|
8.41 KB,
text/plain
|
Details |
Assertion failed: (u.pushed.kind == u.var.kind && u.pushed.kind == u.phi.kind) in jsanalyze.h:633. Backtrace attached. Prevents launching the browser for me with an x86_64 debug build.
|
Reporter | |
Comment 1•13 years ago
|
||
> types::TypeSet *poppedTypes(const jsbytecode *pc, uint32_t which) {
> return getValueTypes(poppedValue(pc, which));
> }
(gdb) p poppedValue(pc, which)
$4 = (const js::analyze::SSAValue &) @0x30: <error reading variable>
|
||
Comment 2•13 years ago
|
||
IsSimpleScript is on the stack. Regression from bug 783008?
|
|
Reporter | |
Comment 3•13 years ago
|
||
Appears so. Marking duplicate, since it was backed out.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•