617589 - TypeInference: Assertion failure: !ic.pools[index]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
var x;
x = x;
x = Math.ceil(NaN);
print(x);
--
./js -m test.js
Assertion failure: !ic.pools[index], at ../methodjit/MonoIC.cpp:491

Comment 1

[Brian Hackett [Laid off!]]

Attachment: fix

Another nice catch.  If an IC stub does the actual operation and triggers recompilation of the calling script, the IC becomes garbage and can't be accessed further.  The stub can detect this by querying f.jit()->recompilations and comparing with an earlier value; this was done for scripted call ICs but not native call ICs (oops).  This patch also adds tests for setprop and getprop calling a getter/setter, which I had examined earlier but not added tests for.

http://hg.mozilla.org/projects/jaegermonkey/rev/6f89a3ddb09e