Closed
Bug 755832
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: [infer failure] Missing type pushed 0: <0x102503060>
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: jandem)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
(deleted),
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
./js --ion-eager
var x;
function f(o) {
o.prop = x = 3;
}
f({});
try { f(1); } catch (e) {}
Assertion failure: [infer failure] Missing type pushed 0: <0x102503060>, at js/src/jsinfer.cpp:353
|
Assignee | |
Comment 1•13 years ago
|
||
Small bug: the resumepoint after a setgname did not include the value (on top of the stack). The patch moves the resumeAfter call after pushing the value so that the value is still on the stack for the SETPROP in the testcase.
|
|
Assignee | |
Comment 2•13 years ago
|
||
To be more precise, the resumepoint was created before popping the global object and pushing the value, so it includes the global object instead of the value (hence the inference failure, <0x102503060> is a global object).
Comment on attachment 625036 [details] [diff] [review]
Patch
Review of attachment 625036 [details] [diff] [review]:
-----------------------------------------------------------------
Yikes. Good find. I think this was the first function to use resume points.
Attachment #625036 -
Flags: review?(dvander) → review+
|
|
Assignee | |
Comment 4•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
|
||
Comment 5•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/ion/bug755832.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•