608489 - Fatal AccSet error assert on this testcase

Status: RESOLVED DUPLICATE of bug 608313

(Core :: JavaScript Engine, defect)

Description

[Boris Zbarsky [:bzbarsky]]

STEPS TO REPRODUCE:

1) Download the shell testcase from the URL field
2) Run it in a debug shell with -j

RESULTS:
Assertion failure: LIR AccSet error (start of writer pipeline): 'sti' AccSet is '.tdata'; base = (ldq2 = ldq.tarray/c ldq1[32]); disp = 0: 0 (../nanojit/LIR.cpp:3193)
Segmentation fault

Comment 1

[Boris Zbarsky [:bzbarsky]]

Nominating, since this seems bad.

Comment 2

[Nicholas Nethercote [inactive]]

(In reply to comment #1)
> Nominating, since this seems bad.

Thankfully, it's probably not.  I'm confident that it's just the AccSet checker being slightly too strict.  I'm also confident that this is a dup of bug 608313.  I'll test both those hypotheses when I get a chance to look at this on Monday!

Comment 4

[Nicholas Nethercote [inactive]]

Sayre: another dup-of-a-fixed-bug marked as a blocker.  Again, I've removed the flag.