617440 - TypeInference: Assertion failure: frame.stackDepth() == opinfo->stackDepth

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

./js -m
js> var x = 1.23; x = x--;
Assertion failure: frame.stackDepth() == opinfo->stackDepth, at ../methodjit/Compiler.cpp:955
Bus error

Comment 1

[Brian Hackett [Laid off!]]

Attachment: fix

GLOBALINC/etc. opcodes were a little messed up for type inference, this makes the code look like LOCALINC.  Though this code isn't long for the world anyways wrt writable properties (bug 617171), and while inference can address the non-writable properties issue it will probably be best to keep GLOBAL and GNAME opcodes coalesced and just use invalidation to remove the GNAME ics.

http://hg.mozilla.org/projects/jaegermonkey/rev/acb93b3060d5

Comment 2

[Jan de Mooij [:jandem]]

This triggers another assert now:

./js -m
js> var x = 1.23; x = x--;
Assertion failure: unsigned(sp - entries) < feLimit(), at ../methodjit/FrameState-inl.h:221

Comment 3

[Brian Hackett [Laid off!]]

Oops, I neglected to mark GLOBALINC/etc. opcodes as needing another TMPSLOT, like LOCALINC.  This didn't show up in the modified test because that has other operations going on which establish the necessary stack depth.

http://hg.mozilla.org/projects/jaegermonkey/rev/710a6281442a