Closed Bug 617592 Opened 9 years ago Closed 9 years ago

TypeInference: Assertion failure: Call site vanished.

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: bhackett)

References

(Blocks 1 open bug)

Details

(Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 file)

./js -m
js> var x; -(x === null);
Assertion failure: Call site vanished., at ../methodjit/Compiler.cpp:2257
Bus error
Attached patch fixSplinter Review
jsop_stricteq() could look at the known types of its operands and decide to push a constant value, which should not happen --- constants and copies should be consistent across compilations, to avoid the bedlam of e.g. having to test whether we are recompiling whenever something is constant folded.

There are probably plenty more bugs that will hit this assertion, it is the guard whenever recompiling that we emitted a call to the stub that triggered recompilation, and can rejoin the new code.  Need to do an audit to look for these, but fortunately they lead to a prompt safe crash, and are easy to diagnose and fix.  For now, any more testcases which trigger this assert are welcome, no testcase reduction is needed.

http://hg.mozilla.org/projects/jaegermonkey/rev/9256ed244764
Assignee: general → bhackett1024
Whiteboard: fixed-in-jaegermonkey
Blocks: infer-regress
No longer blocks: TypeInference
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.