"Assertion failure: !ti->typeMap.matches(ti_other->typeMap)" with undeclared global

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
8 years ago
8 years ago

People

(Reporter: Jesse Ruderman, Assigned: gal)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
x86
Mac OS X
assertion, fixed1.9.1, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9.1 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

8 years ago
// b must be undeclared global?
var E = "";
for each (var a in [E, E, 0/0, E]) {
    ++a;
    for each (b in [a, E, a, E, a, E, 0/0]) {
    }
}

Assertion failure: !ti->typeMap.matches(ti_other->typeMap), at ../jstracer.cpp:3780
autoBisect shows this is probably related to bug 489682 :

The first bad revision is:
changeset:   28050:9d7ca9e8c8a5
user:        danderson
date:        Thu May 07 12:16:12 2009 -0700
summary:     Partial typemap in loop exit can lead to maltyped nested trees (489682, r=gal).
Blocks: 489682
Flags: blocking1.9.1?
Keywords: regression

Updated

8 years ago
Flags: blocking1.9.1? → blocking1.9.1+
Whiteboard: [needs assignee]
(Assignee)

Comment 2

8 years ago
this has danderson or me all over it
Assignee: general → gal
(Assignee)

Updated

8 years ago
Whiteboard: [needs assignee]
(Assignee)

Comment 3

8 years ago
Created attachment 381193 [details] [diff] [review]
patch

Make sure to mark slots a tree grew later are also marked as undemotable when stablizing a tree.
(Assignee)

Comment 4

8 years ago
Created attachment 381195 [details] [diff] [review]
add additional assert and test case
Attachment #381193 - Attachment is obsolete: true
Attachment #381195 - Flags: review?
Attachment #381195 - Flags: review? → review+

Comment 5

8 years ago
http://hg.mozilla.org/tracemonkey/rev/daf5763d7da4
Whiteboard: fixed-in-tracemonkey

Comment 6

8 years ago
http://hg.mozilla.org/mozilla-central/rev/daf5763d7da4
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED

Comment 7

8 years ago
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/ba731d4f9b0a
Keywords: fixed1.9.1
Flags: in-testsuite+

Comment 8

8 years ago
v 1.9.3, 1.9.2
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.