608313 - TM: AccSet assertion failure in typed arrays

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: test case

I hit this while writing test cases for typed arrays in JM.

Assertion failure: LIR AccSet error (start of writer pipeline): 'ldc2i' AccSet is '.tdata'; base = (ldi9 = ldi.tarray/c private3[24]); disp = 0: 0 (../nanojit/LIR.cpp:3193)

Attached test fails with -m -j on tm-tip

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Looks like it has something to do with using a constant index.

Comment 3

[Nicholas Nethercote [inactive]]

(In reply to comment #1)
> Looks like it has something to do with using a constant index.

Indeed it does.

Comment 4

[Nicholas Nethercote [inactive]]

Attachment: patch (against TM 56610:7af31ff1e9f5)

Allow for constant indexes in typed arrays.  Also, strengthen the checking slightly by insisting that the TARRAY base pointer is loaded using LOAD_CONST.

Comment 5

[Nicholas Nethercote [inactive]]

http://hg.mozilla.org/tracemonkey/rev/2098bd53381e

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/2098bd53381e