462407 - TM: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" #4

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

for each (let i in [0, {}, 0, 1.5, {}, 0, 1.5, 0, 0]) { }

Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap), at jstracer.cpp:2730

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fix

When attempting to re-stabilize because of unpromotable slots, also mark as unpromotable any slots which were double to begin with.

Note: I expect this assertion to rear up a few more times.  I'm trying to get all the easy cases -- resorting to the oracle in any aggressive manner is a 10-15ms perf loss on my machine.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed changeset as http://hg.mozilla.org/tracemonkey/rev/d799b532a33a (took this opportunity to use better names for the DEMOTE macros).

Comment 3

[Bob Clary [:bc] (inactive)]

http://hg.mozilla.org/mozilla-central/rev/37b3fdbb0f07
/cvsroot/mozilla/js/tests/js1_7/regress/regress-462407.js,v  <--  regress-462407.js
initial revision: 1.1