TM: AccSet assertion failure in typed arrays

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: dvander, Assigned: njn)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(2 attachments)

Created attachment 486951 [details]
test case

I hit this while writing test cases for typed arrays in JM.

Assertion failure: LIR AccSet error (start of writer pipeline): 'ldc2i' AccSet is '.tdata'; base = (ldi9 = ldi.tarray/c private3[24]); disp = 0: 0 (../nanojit/LIR.cpp:3193)

Attached test fails with -m -j on tm-tip
Looks like it has something to do with using a constant index.
(Assignee)

Updated

7 years ago
Duplicate of this bug: 608489
(Assignee)

Comment 3

7 years ago
(In reply to comment #1)
> Looks like it has something to do with using a constant index.

Indeed it does.
(Assignee)

Comment 4

7 years ago
Created attachment 487269 [details] [diff] [review]
patch (against TM 56610:7af31ff1e9f5)

Allow for constant indexes in typed arrays.  Also, strengthen the checking slightly by insisting that the TARRAY base pointer is loaded using LOAD_CONST.
Assignee: general → nnethercote
Status: NEW → ASSIGNED
Attachment #487269 - Flags: review?(dvander)
Attachment #487269 - Flags: review?(dvander) → review+
(Assignee)

Comment 5

7 years ago
http://hg.mozilla.org/tracemonkey/rev/2098bd53381e
Whiteboard: fixed-in-tracemonkey

Comment 6

7 years ago
http://hg.mozilla.org/mozilla-central/rev/2098bd53381e
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.