Closed Bug 452853 Opened 11 years ago Closed 11 years ago

TM: "Assertion failed: !i->isTramp()"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: dvander)

References

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

./js -j
js> for (var j=0; j<4; ++j) { var a = ["", ""]; a[0] * a[1]; }

Assertion failed: !i->isTramp() (nanojit/LIR.cpp:252)
Nanojit changes the contents of the args array you pass in.  In binary() the same array gets used twice, so the cx_ins entry in args[1] cab get clobbered.  Attached patch uses separate arrays for each call.
Assignee: general → danderson
Status: NEW → ASSIGNED
Attachment #336105 - Flags: review?(gal)
Pushed fix as changeset a1352c8a58a8.
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
No longer blocks: 349611
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-452853.js,v  <--  regress-452853.js
initial revision: 1.1

m-c: changeset:   19292:05120f3c5778
Flags: in-testsuite+
Flags: in-litmus-
Attachment #336105 - Flags: review?(gal) → review+
Summary: "Assertion failed: !i->isTramp()" → TM: "Assertion failed: !i->isTramp()"
You need to log in before you can comment on or make changes to this bug.