466128 - TM: "Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap)" #5

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

for (let a = 0; a < 3; ++a) { 
  for each (let b in [1, 2, "three", 4, 5, 6, 7, 8]) {
  }
}

Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap), at ../jstracer.cpp:2964

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fix

Need to keep a list of which trees to trash.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix as changeset http://hg.mozilla.org/tracemonkey/rev/6d441358bc57

Comment 3

[Bob Clary [:bc] (inactive)]

Checking in js1_8/regress/regress-466128.js;
/cvsroot/mozilla/js/tests/js1_8/regress/regress-466128.js,v  <--  regress-466128.js
initial revision: 1.1
done

Comment 4

[Shawn Wilsher :sdwilsh]

http://hg.mozilla.org/mozilla-central/rev/c9ac7dc9e0b4

Comment 5

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/94751396e8c9

Comment 6

[Bob Clary [:bc] (inactive)]

test included in js1_8_1/trace/trace-test.js 
http://hg.mozilla.org/mozilla-central/rev/8f967a7729e2

Comment 7

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2