602413 - "Assertion failure: !f->typeMap.matches(peer->typeMap)"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: shell testcase, 44 lines

Assertion failure: !f->typeMap.matches(peer->typeMap), at ../jstracer.cpp:1583

The testcase took me a while to reduce and it's fragile, so I'd appreciate a fix before the bug mutates ;)

Comment 1

[Jesse Ruderman]

Attachment: autobisect results

autobisect says this goes back to august, at least.

Comment 2

[Luke Wagner [:luke]]

Thanks for the work Jesse.  It still repros for me.

Comment 3

[Luke Wagner [:luke]]

Attachment: heh

Let's see if I can't write a reduced testcase.

Comment 4

[Luke Wagner [:luke]]

Attachment: cleanup

While I was in the area, I tidied up.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 489942 [details] [diff] [review]
cleanup

Nice, thanks for cleaning up this old recursion cruft.

Comment 6

[Luke Wagner [:luke]]

Due to the incredible coincidences required, its hard to come up with a testcase simpler than Jesse's, so I'm just going to add that.

Comment 7

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/2e91aa1d2ff5
http://hg.mozilla.org/tracemonkey/rev/ba3f9d1c5e5e

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/ba3f9d1c5e5e

Comment 9

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug602413.js.