620232 - Assertion failure: hasInt32Repr(*(const Value *)p), at jstracer.cpp:3414

Status: RESOLVED DUPLICATE of bug 620662

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following code causes an assertion (shell) on trunk (tested with beta 8 and mozilla-central trunk):

options('tracejit');
function f() {
        (function () {
            for (var b = 0; b < 2; ++b) {
                (function () {
                    for (var c = 0; c < 1; ++c) {
                        while (b=false) return;
                    }
                })();
            }
        })();
}

f(65535);

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

This WFM on tm-tip, OS X x86 and x64. Do you still get this assertion?

Comment 2

[Nicholas Nethercote [inactive]]

Bug 620532 may have fixed this?  See bug 620532 comment 12.  It landed on tracemonkey yesterday.

Comment 3

[Jesse Ruderman]

Still asserts for me with a 32-bit shell on Mac OS X 10.5. (Tested revs e10bd9b6cea0, b4552d5b76ef, and 61e3418e4223.)

Comment 4

[Nicholas Nethercote [inactive]]

dvander, did you run with -j?  You shouldn't, because of the options('tracejit') line.