669706 - TI: Assertion failure: hasTypeBarriers(PC), at methodjit/Compiler.cpp:4879

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision f59a6cabfbd4 (run with -j -m -a -n), tested on 64 bit:


function printStatus(msg) {
    msg.toString()
    lines = msg
    for (var i = 0; i < lines;) i
}
var summary = new Float32Array;
try {
    printStatus(summary)
    x = {
    }
    toString.__proto__ = x
} catch (e) {}
var summary = 6;
printStatus(summary)

Comment 1

[Brian Hackett [Laid off!]]

Subtle issue with how we handle mutable __proto__.  Kind of hard to pin down exactly what's wrong, the invariants around mutable __proto__ are a mess.  I know how to fix bug 656727 (in a way that gives perf benefits on scripts where we can't do much useful analysis of objects, like jslint) and will be doing that within the next couple days.

Comment 2

[Brian Hackett [Laid off!]]

Fixed as part of bug 670185, testcase included in that patch.

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug669706.js.