Closed Bug 582900 Opened 14 years ago Closed 14 years ago

JM: "Assertion failure: !fe->type.isConstant(),"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: gkw, Assigned: cdleary)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 file, 1 obsolete file)

Fold (unknown, int) case into (unknown, unknown).
(deleted), patch
dvander
: review+
Details | Diff | Splinter Review
[].x >>= a | 0 asserts js debug shell on JM changeset 3700c42a8e82 with -m at Assertion failure: !fe->type.isConstant(), at ../methodjit/FrameState-inl.h:387
(In reply to comment #1) > regression from bug 578517 ? Most likely. Looking...
Assignee: general → cdleary
Status: NEW → ASSIGNED
Attached patch Add extra case. (obsolete) (deleted) — — Splinter Review
Missed an obvious case in the rush to get mas perf!
Attachment #461209 - Flags: review?(dvander)
Comment on attachment 461209 [details] [diff] [review] Add extra case. Can we fit this into the unknown_unknown case instead? It looks like this would be a smaller fix.
(In reply to comment #4) > Can we fit this into the unknown_unknown case instead? Sure -- breaks the nice two-tuple method names tho. unknown_unknownOrInt seem ok?
Attachment #461209 - Attachment is obsolete: true
Attachment #461279 - Flags: review?(dvander)
Attachment #461209 - Flags: review?(dvander)
Comment on attachment 461279 [details] [diff] [review] Fold (unknown, int) case into (unknown, unknown). thanks!
Attachment #461279 - Flags: review?(dvander) → review+
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Depends on: 593554
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug582900.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: