Closed
Bug 600419
Opened 14 years ago
Closed 14 years ago
"Assertion failure: fe_" with x<<x (LSH)
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Unassigned)
References
Details
(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(2 files)
|
3.48 KB,
text/plain
|
Details | |
|
815 bytes,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
js -m
(function(){ var x; [1].map(function(){}, x << x); })()
Assertion failure: fe_, at js/src/methodjit/FrameState.h:245
The first bad revision is:
changeset: 1bbc0fc10747
user: David Anderson
date: Tue Sep 21 18:34:42 2010 -0700
summary: Optimize FrameState for large linear scripts (bug 591836, r=dmandelin).
Seems superficially similar to bug 596817, but that bug had a different regressor and a different fix.
|
Reporter | |
Comment 1•14 years ago
|
||
|
|
Reporter | |
Updated•14 years ago
|
Blocks: JaegerFuzz
|
||
Comment 2•14 years ago
|
||
Only reproduces on x86, not x64.
|
|
||
Comment 3•14 years ago
|
||
copyDataIntoReg() calls forgetReg() if we're out of registers [x86 has greater register pressure, explaining why x64 doesn't see this]. But jsop_bitop() has pinned the data register, so it can't be forgotten.
This only uses pinReg() in the case where it's necessary.
Attachment #479840 -
Flags: review?(dvander)
|
||
Updated•14 years ago
|
Attachment #479840 -
Flags: review?(dvander) → review+
|
|
||
Comment 5•14 years ago
|
||
Whiteboard: fixed-in-tracemonkey
|
||
Comment 6•14 years ago
|
||
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
||
Comment 7•12 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug600419.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•