Closed Bug 617589 Opened 9 years ago Closed 9 years ago

TypeInference: Assertion failure: !ic.pools[index]

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: bhackett)

References

(Blocks 1 open bug)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 file)

--
var x;
x = x;
x = Math.ceil(NaN);
print(x);
--
./js -m test.js
Assertion failure: !ic.pools[index], at ../methodjit/MonoIC.cpp:491
Attached patch fixSplinter Review
Another nice catch.  If an IC stub does the actual operation and triggers recompilation of the calling script, the IC becomes garbage and can't be accessed further.  The stub can detect this by querying f.jit()->recompilations and comparing with an earlier value; this was done for scripted call ICs but not native call ICs (oops).  This patch also adds tests for setprop and getprop calling a getter/setter, which I had examined earlier but not added tests for.

http://hg.mozilla.org/projects/jaegermonkey/rev/6f89a3ddb09e
Assignee: general → bhackett1024
Whiteboard: fixed-in-jaegermonkey
Blocks: infer-regress
No longer blocks: TypeInference
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.