Closed Bug 650658 Opened 13 years ago Closed 13 years ago

TI: Assertion failure: !fe->isConstant(), at ./methodjit/FrameState-inl.h:510

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase) 

The following testcase asserts on TI revision ac0989a03bf1 (run with options -m -a -n), tested on 32 bit:

AddRegExpCases(/a*b/, "xxx", 0, null );
AddRegExpCases(/x\d\dy/, "abcx45ysss235", 3,[] );
function AddRegExpCases(regexp, pattern, index, matches_array ) 
        (matches_array.length, regexp)
This is the same basic issue as bug 650662, but exposed an additional problem that when emitting code for JSOP_LENGTH we don't always include rejoin points for calls associated with JSOP_GETPROP (which LENGTH is sometimes but not always implemented in terms using).

http://hg.mozilla.org/projects/jaegermonkey/rev/0178e1b19f45
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.