617592 - TypeInference: Assertion failure: Call site vanished.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

./js -m
js> var x; -(x === null);
Assertion failure: Call site vanished., at ../methodjit/Compiler.cpp:2257
Bus error

Comment 1

[Brian Hackett [Laid off!]]

Attachment: fix

jsop_stricteq() could look at the known types of its operands and decide to push a constant value, which should not happen --- constants and copies should be consistent across compilations, to avoid the bedlam of e.g. having to test whether we are recompiling whenever something is constant folded.

There are probably plenty more bugs that will hit this assertion, it is the guard whenever recompiling that we emitted a call to the stub that triggered recompilation, and can rejoin the new code.  Need to do an audit to look for these, but fortunately they lead to a prompt safe crash, and are easy to diagnose and fix.  For now, any more testcases which trigger this assert are welcome, no testcase reduction is needed.

http://hg.mozilla.org/projects/jaegermonkey/rev/9256ed244764