JM: "Assertion failure: regstate[fe->type.reg()].fe() == fe,"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
x86
Linux
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 beta7+)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
(function(){for(var[x]=x>>x in[[]<[]]){[]}})()

asserts js debug shell on TM changeset a409054e1395 with -m at Assertion failure: regstate[reg].fe,
(Reporter)

Updated

7 years ago
blocking2.0: --- → ?

Comment 1

7 years ago
The first bad revision is:
changeset:   53581:5a9241e86ecc
user:        Sean Stangl <sstangl@mozilla.com>
date:        Mon Sep 13 16:47:57 2010 -0400
summary:     Fix isNotType() usage in jsop_rhs_unknown_any(). b=593554, r=dvander.

(This is the first bad revision for both 32-bit and 64-bit.)
Blocks: 549412
Created attachment 477837 [details] [diff] [review]
Fix rsh, storeTo() bugs involving allocReg().

The rsh logic did not handle the haveSameBacking(lhs, rhs) case. Additionally, I realized that a similar bug is present in storeTo(), so it is fixed here.
Attachment #477837 - Flags: review?(dvander)

Updated

7 years ago
blocking2.0: ? → beta7+
Attachment #477837 - Flags: review?(dvander) → review+
(Reporter)

Comment 3

7 years ago
Now asserts at Assertion failure: regstate[fe->type.reg()].fe() == fe, in TM changeset 491044fa498a
(Reporter)

Updated

7 years ago
Summary: JM: "Assertion failure: regstate[reg].fe," → JM: "Assertion failure: regstate[fe->type.reg()].fe() == fe,"

Comment 4

7 years ago
checked in?
Comment on attachment 477837 [details] [diff] [review]
Fix rsh, storeTo() bugs involving allocReg().

Gary says this still asserts, marking patch so it doesn't get checked in.
Attachment #477837 - Flags: review+ → review-
Whoops - might have jumped the gun here. Gary, were you testing with this patch, or just saying that the assertion is different now?

Updated

7 years ago
Duplicate of this bug: 600129
(In reply to comment #6)
> Whoops - might have jumped the gun here. Gary, were you testing with this
> patch, or just saying that the assertion is different now?

He meant that the assertion changed. The patch fixes the problem, and with it there is no assertion.
Comment on attachment 477837 [details] [diff] [review]
Fix rsh, storeTo() bugs involving allocReg().

Okay, sorry about that
Attachment #477837 - Flags: review- → review+
http://hg.mozilla.org/tracemonkey/rev/32c14e640a89
Whiteboard: fixed-in-tracemonkey
(Reporter)

Comment 11

7 years ago
(In reply to comment #8)
> (In reply to comment #6)
> > Whoops - might have jumped the gun here. Gary, were you testing with this
> > patch, or just saying that the assertion is different now?
> 
> He meant that the assertion changed.

Yup, that's what I meant. ;-)

Comment 12

7 years ago
http://hg.mozilla.org/mozilla-central/rev/32c14e640a89
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.