Closed
Bug 723139
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: JSVAL_IS_DOUBLE_IMPL(l), at ../jsval.h:416
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(1 file)
|
(deleted),
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
sunspider/check-3d-cube.js triggers this assert with --ion -n.
Tricky LSRA edge caase. If a block has multiple phis, and one phi reuses the dead stack slot of an input to another phi, we could add two conflicting moves to the predecessor exit movegroup, and we could move the new value to the stack slot before moving the (dead) stack value into a register.
Attachment #593468 -
Flags: review?(dvander)
Comment on attachment 593468 [details] [diff] [review]
Patch
Review of attachment 593468 [details] [diff] [review]:
-----------------------------------------------------------------
Yuck. nice catch
Attachment #593468 -
Flags: review?(dvander) → review+
|
Assignee | |
Comment 2•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•