1368584 - Assertion failure: !ins->hasDefUses(), at js/src/jit/TypePolicy.cpp:302

Status: RESOLVED DUPLICATE of bug 1368576

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 34ac1a5d6576 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --ion-eager):

(function () {
    "use strict";
    for (let x of []) {
        let y = {} = this;
    }
})();


Backtrace:

#0  0x0000000000833a40 in js::jit::TypeBarrierPolicy::adjustInputs (this=<optimized out>, alloc=..., def=0x7ff39019eaa0) at js/src/jit/TypePolicy.cpp:302
#1  0x00000000006e37c5 in (anonymous namespace)::TypeAnalyzer::adjustInputs (def=0x7ff39019eaa0, this=0x7fff1f8543e0) at js/src/jit/IonAnalysis.cpp:1686
#2  (anonymous namespace)::TypeAnalyzer::insertConversions (this=0x7fff1f8543e0) at js/src/jit/IonAnalysis.cpp:1753
#3  (anonymous namespace)::TypeAnalyzer::analyze (this=0x7fff1f8543e0) at js/src/jit/IonAnalysis.cpp:2000
#4  js::jit::ApplyTypeInformation (mir=mir@entry=0x7ff39018c2b0, graph=...) at js/src/jit/IonAnalysis.cpp:2012
#5  0x00000000006ff477 in js::jit::OptimizeMIR (mir=mir@entry=0x7ff39018c2b0) at js/src/jit/Ion.cpp:1538
#6  0x0000000000700db5 in js::jit::CompileBackEnd (mir=mir@entry=0x7ff39018c2b0) at js/src/jit/Ion.cpp:1959
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Sorry, duping.