585408 - JM: "Assertion failure: !fe->type.isConstant(),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
  function a() {}
  a.e = a++
})()

asserts js debug shell on JM changeset 787e35063545 with -m at Assertion failure: !fe->type.isConstant(), at ../methodjit/FrameState-inl.h:393

Comment 1

[Sean Stangl [:sstangl]]

jsop_localinc() calls frame.forgetType(frame.peek(-1)), but that frame is a copy of a FrameEntry where the type is known.

jsop_setprop() then checks whether the type is known, sees that it isn't, calls tempRegForType(). That function works with fe->copyOf(), so it asserts that the value is constant.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Hrm. There shouldn't be a copy here in the first place. Investigating

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Oh, fine. For LOCALINC with an observed value, and also cases where the type is known to be not int32, just break the op down into more primitive operations. No point in being super clever.

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/92c4c89c5ba8

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug585408-3.js.