Closed
Bug 973620
Opened 11 years ago
Closed 11 years ago
Assertion failure: consumer->isConsistentFloat32Use(), at jit/IonAnalysis.cpp:979 or Crash [@ js::jit::LIRGenerator::visitToString]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 966926
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase)
The following testcase asserts on mozilla-central revision f6ab28f98ee5 (x86 ARM simulator build, run with --fuzzing-safe):
setJitCompilerOption("ion.usecount.trigger", 1);
var f32 = new Float32Array(32);
function f(n) {
var x;
if (n > 10000) {
x = 4.5;
} else {
x = f32[0];
}
f32[0] = "" + x;
}
for (var n = 0; n < 50; n++)
f(n);
|
Reporter | |
Comment 1•11 years ago
|
||
I thought I reported this one already, but seems like I didn't :)
No longer blocks: IonFuzz
|
||
Comment 2•11 years ago
|
||
decoder said the build may be older than the revision in comment 0 and according to Benjamin it looks like bug 966926.
|
|
Reporter | |
Comment 3•11 years ago
|
||
Ah thanks. I remembered I had seen this before.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
|
||
Updated•9 years ago
|
Group: core-security → core-security-release
|
||
Updated•8 years ago
|
Group: core-security-release
|
||
Updated•3 years ago
|
Assignee: general → nobody
QA Contact: general
You need to log in
before you can comment on or make changes to this bug.
Description
•