TypeInference: Assertion failure: frame.stackDepth() == opinfo->stackDepth

RESOLVED FIXED

Status

()

defect
RESOLVED FIXED
9 years ago
9 years ago

People

(Reporter: jandem, Assigned: bhackett)

Tracking

(Blocks 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 attachment)

./js -m
js> var x = 1.23; x = x--;
Assertion failure: frame.stackDepth() == opinfo->stackDepth, at ../methodjit/Compiler.cpp:955
Bus error
Posted patch fixSplinter Review
GLOBALINC/etc. opcodes were a little messed up for type inference, this makes the code look like LOCALINC.  Though this code isn't long for the world anyways wrt writable properties (bug 617171), and while inference can address the non-writable properties issue it will probably be best to keep GLOBAL and GNAME opcodes coalesced and just use invalidation to remove the GNAME ics.

http://hg.mozilla.org/projects/jaegermonkey/rev/acb93b3060d5
Assignee: general → bhackett1024
Whiteboard: fixed-in-jaegermonkey
This triggers another assert now:

./js -m
js> var x = 1.23; x = x--;
Assertion failure: unsigned(sp - entries) < feLimit(), at ../methodjit/FrameState-inl.h:221
Oops, I neglected to mark GLOBALINC/etc. opcodes as needing another TMPSLOT, like LOCALINC.  This didn't show up in the modified test because that has other operations going on which establish the necessary stack depth.

http://hg.mozilla.org/projects/jaegermonkey/rev/710a6281442a
Blocks: infer-regress
No longer blocks: TypeInference
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.