495897 - "Assertion failure: !ti->typeMap.matches(ti_other->typeMap)" with undeclared global

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

// b must be undeclared global?
var E = "";
for each (var a in [E, E, 0/0, E]) {
    ++a;
    for each (b in [a, E, a, E, a, E, 0/0]) {
    }
}

Assertion failure: !ti->typeMap.matches(ti_other->typeMap), at ../jstracer.cpp:3780

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to bug 489682 :

The first bad revision is:
changeset:   28050:9d7ca9e8c8a5
user:        danderson
date:        Thu May 07 12:16:12 2009 -0700
summary:     Partial typemap in loop exit can lead to maltyped nested trees (489682, r=gal).

Comment 2

[Andreas Gal :gal]

this has danderson or me all over it

Comment 3

[Andreas Gal :gal]

Attachment: patch

Make sure to mark slots a tree grew later are also marked as undemotable when stablizing a tree.

Comment 4

[Andreas Gal :gal]

Attachment: add additional assert and test case

Comment 5

[Robert Sayre]

http://hg.mozilla.org/tracemonkey/rev/daf5763d7da4

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/daf5763d7da4

Comment 7

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/ba731d4f9b0a

Comment 8

[Bob Clary [:bc] (inactive)]

v 1.9.3, 1.9.2