Closed
Bug 680797
Opened 13 years ago
Closed 13 years ago
TI: Assertion failure: newShape != initialShape, at methodjit/PolyIC.cpp:384
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase)
Attachments
(1 file)
|
1.21 KB,
application/javascript
|
Details |
The attached testcase asserts on TI revision a2bbe9c999b4 (run with -j -m -n -Z 2), tested on 64 bit.
|
||
Comment 1•13 years ago
|
||
Code-discard hazard introduced by potential GCs with addProperty, during ADDPROP PIC stub generation. This call used to not be a problem since it can't trigger recompilation, but now that we discard code during GC it is problematic. (Another vote for refactoring the ICs to split VM and IC operations into two phases). http://hg.mozilla.org/projects/jaegermonkey/rev/c685e6d17745
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
|
Reporter | |
Comment 2•11 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•