Closed Bug 587431 Opened 11 years ago Closed 11 years ago

JM: "Assertion failure: f.fp == cx->fp,"

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

function g() {
  var UPPER_MASK = 2147483648
  var mt = new Array
  function f1(n1) {
    return n1 < 0 ? (n1 ^ UPPER_MASK) + UPPER_MASK: n1
  }
  function f2(n1, n2) {
    return f1(n1 + n2 & 4294967295)
  }
  function f3(n1, n2) {
    var sum
    for (var i = 0; i < 32; ++i) {
      sum = f2(sum, f1(n2 << i))
    }
    return sum
  }
  this.init_genrand = function(s) {
    mt[0] = f1(s & 96295)
    for (mti = 1; mti < 6; mti++) {
      mt[mti] = f2(f3(3, f1(mt[mti - 1] ^ mt[1] > 0)), mti)
    }
  }
} (function() {
  var fuzzMT = new g;
  fuzzMT.init_genrand(54)
} ())


asserts js debug shell on JM changeset 89b775191b9d with -m and -j at Assertion failure: f.fp == cx->fp, at ../methodjit/InvokeHelpers.cpp:297
http://hg.mozilla.org/projects/jaegermonkey/rev/141dd8d48b1d
Blocks: 578727
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug587431.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.