All users were logged out of Bugzilla on October 13th, 2018

TM: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" with array comprehension

VERIFIED FIXED

Status

()

--
critical
VERIFIED FIXED
10 years ago
10 years ago

People

(Reporter: jruderman, Assigned: dvander)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

10 years ago
[1 for each (x in {a:1, b:1, c:"", d:"", e:1, f:"", g:""}) if (0)];

Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap), at jstracer.cpp:2738

This assertion is part of the "Check for duplicate entry type maps" block added as part of the patch in bug 450833.
edited wrong field... 3AM :(
Assignee: general → danderson

Comment 2

10 years ago
covered by js1_7/extensions/regress-455982-01.js, js1_8/extensions/regress-452476.js
Created attachment 345153 [details] [diff] [review]
proposed fix

My logic for detecting demotions was wrong.  It should only demote if typemap=int and the value on the stack is a number and not promotable.
Attachment #345153 - Flags: review?(gal)

Updated

10 years ago
Attachment #345153 - Flags: review?(gal) → review+
Pushed changeset: http://hg.mozilla.org/tracemonkey/rev/6ab3538891c4
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED

Updated

10 years ago
Depends on: 462142

Comment 5

10 years ago
This assertion no longer fires, but there is a new assertion in bug 462142. Not sure if it is really a different bug.
Status: RESOLVED → VERIFIED

Comment 6

10 years ago
http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_7/regress/regress-461945.js,v  <--  regress-461945.js
initial revision: 1.1
Flags: in-testsuite+
Flags: in-litmus-
(Reporter)

Updated

10 years ago
Summary: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" with array comprehension → TM: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" with array comprehension
You need to log in before you can comment on or make changes to this bug.