Closed Bug 617440 Opened 10 years ago Closed 10 years ago

TypeInference: Assertion failure: frame.stackDepth() == opinfo->stackDepth

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: bhackett1024)

References

(Blocks 1 open bug)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 file)

./js -m
js> var x = 1.23; x = x--;
Assertion failure: frame.stackDepth() == opinfo->stackDepth, at ../methodjit/Compiler.cpp:955
Bus error
Attached patch fixSplinter Review
GLOBALINC/etc. opcodes were a little messed up for type inference, this makes the code look like LOCALINC.  Though this code isn't long for the world anyways wrt writable properties (bug 617171), and while inference can address the non-writable properties issue it will probably be best to keep GLOBAL and GNAME opcodes coalesced and just use invalidation to remove the GNAME ics.

http://hg.mozilla.org/projects/jaegermonkey/rev/acb93b3060d5
Assignee: general → bhackett1024
Whiteboard: fixed-in-jaegermonkey
This triggers another assert now:

./js -m
js> var x = 1.23; x = x--;
Assertion failure: unsigned(sp - entries) < feLimit(), at ../methodjit/FrameState-inl.h:221
Oops, I neglected to mark GLOBALINC/etc. opcodes as needing another TMPSLOT, like LOCALINC.  This didn't show up in the modified test because that has other operations going on which establish the necessary stack depth.

http://hg.mozilla.org/projects/jaegermonkey/rev/710a6281442a
Blocks: infer-regress
No longer blocks: TypeInference
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.