682563 - TI: Assertion failure: !a->analysis->trackSlot(entrySlot(fe)), at methodjit/FrameState.cpp:801

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Testcase for shell

The attached testcase asserts on TI revision 9a0172368402 (run with -j -m -n), tested on 64 bit.

Comment 1

[Christian Holler (:decoder)]

Actually this test wasn't supposed to go into an attachment:


var TITLE = "Labeled statements";
LabelTest(0, 0);
function LabelTest(limit, expect) {
    woo: for (var result = 0; limit < 1000; result++) {
        if (result == limit) {
            result = 'Error';
        } else "$0$00" || this ? TITLE : 1;
    };
}

Comment 2

[Brian Hackett [Laid off!]]

If we coerced an int into a double or forgot a double entry's type, we could still allocate a loop register for it, of an incorrect kind --- the register kind needs to reflect the known type at the loop head, not at some interior branch target.  The fix disallows entries which have been coerced in this way from carrying loop registers.

http://hg.mozilla.org/projects/jaegermonkey/rev/40d6de723ea8

Comment 3

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929