Closed
Bug 621816
Opened 13 years ago
Closed 13 years ago
"Assertion failure: unexpected constantly false guard detected" with typed array
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: n.nethercote)
Details
(Keywords: assertion, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
1.02 KB,
patch
|
vlad
:
review+
|
Details | Diff | Splinter Review |
for (let j=0; j<9; ++j) { var a = new Int8Array(); a[0] = 5; a[0]; } Assertion failure: unexpected constantly false guard detected, at jstracer.cpp:4328 The first bad revision is: changeset: http://hg.mozilla.org/tracemonkey/rev/0084457d2cfc user: Nicholas Nethercote date: Mon Oct 18 12:55:56 2010 -0700 summary: Bug 584279 - TM: improve alias analysis by adding many more access regions (2nd attempt). r=bhackett.
![]() |
Assignee | |
Comment 1•13 years ago
|
||
This is simple. The a[0] SETELEM bounds check always fails, so we always side-exit on it (though Nanojit doesn't detect that it always fails). However, Nanojit does determine that the a[0] GETELEM bounds check always fails, so it complains. This is an unlikely case, so we can just abort. The attached patch does this. There's no need for this to block 2.0. In an optimized build the tracejit will generate correct but sub-optimal code.
Attachment #501234 -
Flags: review?(vladimir) → review+
Updated•13 years ago
|
![]() |
Assignee | |
Comment 2•13 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/881166c2051f
Whiteboard: fixed-in-tracemonkey
Comment 3•13 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/881166c2051f
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Comment 4•11 years ago
|
||
Automatically extracted testcase for this bug was committed: https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•