462282 - TM: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" #3

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

for each (let i in [0, 0, 0, "", 0, 0, "", 0, 0, "", 0]) { }

Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap), at jstracer.cpp:2727

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fix

Awesome bug - linked peers must be dependent or else much badness ensues when one gets trashed.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: actual proposed fix

whoops, forgot to use addUnique

Comment 3

[Andreas Gal :gal]

Comment on attachment 345463 [details] [diff] [review]
actual proposed fix

Ouch. Yeah add would have been bad.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix as changeset: http://hg.mozilla.org/tracemonkey/rev/d148e3a94d2f

Comment 5

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_7/regress/regress-462282.js,v  <--  regress-462282.js
initial revision: 1.1