Fixed bogus assertion in a rare type-instability case (bug 470061, r=gal).
authorDavid Anderson <danderson@mozilla.com>
Thu, 18 Dec 2008 03:15:09 -0500
changeset 23091 8353e26475a8866498ad1da8d2fa8848b9f033a5
parent 23090 59d774acdd37a9bda4e380dbe921d2b3ef450a6d
child 23092 e6c176faad6bd208cd006056e7197abb20989679
push id4346
push userrsayre@mozilla.com
push dateFri, 26 Dec 2008 01:26:36 +0000
treeherdermozilla-central@8eb5a5b83a93 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersgal
bugs470061
milestone1.9.2a1pre
Fixed bogus assertion in a rare type-instability case (bug 470061, r=gal).
js/src/jstracer.cpp
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -2955,17 +2955,17 @@ js_dumpMap(TypeMap const & tm) {
         printf("typemap[%d] = %c\n", i, typeChar[data[i]]);
     }
 }
 #endif
 
 JS_REQUIRES_STACK bool
 js_RecordTree(JSContext* cx, JSTraceMonitor* tm, Fragment* f, Fragment* outer, unsigned* demotes)
 {
-    JS_ASSERT(cx->fp->regs->pc == f->ip && f->root == f);
+    JS_ASSERT(f->root == f);
     
     /* Avoid recording loops in overlarge scripts. */
     if (cx->fp->script->length >= SCRIPT_PC_ADJ_LIMIT) {
         js_AbortRecording(cx, "script too large");
         return false;
     }
 
     /* Make sure the global type map didn't change on us. */