461945 - TM: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" with array comprehension

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

[1 for each (x in {a:1, b:1, c:"", d:"", e:1, f:"", g:""}) if (0)];

Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap), at jstracer.cpp:2738

This assertion is part of the "Check for duplicate entry type maps" block added as part of the patch in bug 450833.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

edited wrong field... 3AM :(

Comment 2

[Bob Clary [:bc] (inactive)]

covered by js1_7/extensions/regress-455982-01.js, js1_8/extensions/regress-452476.js

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fix

My logic for detecting demotions was wrong.  It should only demote if typemap=int and the value on the stack is a number and not promotable.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed changeset: http://hg.mozilla.org/tracemonkey/rev/6ab3538891c4

Comment 5

[Bob Clary [:bc] (inactive)]

This assertion no longer fires, but there is a new assertion in bug 462142. Not sure if it is really a different bug.

Comment 6

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_7/regress/regress-461945.js,v  <--  regress-461945.js
initial revision: 1.1