Closed
Bug 678653
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: regs.sp == regs.fp()->base(), at jsinterp.cpp:2390
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: adrake, Unassigned)
References
(Blocks 1 open bug)
Details
Attachments
(1 file)
|
(deleted),
application/javascript
|
Details |
Attached test case asserts from within bailout on ionmonkey x86 debug.
|
Reporter | |
Comment 1•13 years ago
|
||
(You need the double patches for lsra landed/applied)
|
|
Reporter | |
Comment 2•13 years ago
|
||
Just updated to tip, now this assert happens with the greedy allocator enabled, too.
This was fixed by bug 677339, unclear how but it fixed some bugs in type analysis.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•