Closed Bug 621655 Opened 9 years ago Closed 9 years ago

TypeInference: JM: "Assertion failure: !fe->isType(JSVAL_TYPE_DOUBLE)"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: jandem)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, regression, testcase, Whiteboard: fixed-in-jaegermonkey)

Attachments

(1 file)

./js -m
for (p in .3) { }

Assertion failure: !fe->isType(JSVAL_TYPE_DOUBLE), 
at methodjit/FrameState-inl.h:463

The first bad revision is:
changeset:   http://hg.mozilla.org/projects/jaegermonkey/rev/0cd7e38f0b39
user:        Brian Hackett
date:        Fri Oct 29 08:05:55 2010 -0700
summary:     [INFER] Javascript type inference, bug 557407.
Attached patch FixSplinter Review
Type inference assigns a double type to the stack slots for the ITER/FOR* opcodes and sets ignoreTypeTag to true. moreIter then calls fixDoubleTypes, which ignores this flag, and assigns a double tag to the iterator object. moreIter then calls tempRegForData and this asserts because it does not expect a double.

This patch adds a check for ignoreTypeTag to fixDoubleTypes. I had to rewrite the loop to be more like the one in restoreAnalysisTypes, so I could access the ignoreTypeTag flag.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #500006 - Flags: review?(bhackett1024)
This will I think be unnecessary after the patch for bug 621301 lands tonight (will double check).  That changes things so that types are restored/fixed only for locals and args at basic block boundaries, mirroring the regalloc.  ignoreTypeTag is gone (along with TypeStack), but the horrible iteration hack is still there and can probably bite in other ways --- should find a cleaner fix.
OS: Mac OS X → Windows 7
This testcase works now.

http://hg.mozilla.org/projects/jaegermonkey/rev/fbeecf1d1f4c
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
Attachment #500006 - Flags: review?(bhackett1024)
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug621655.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.