Closed Bug 638977 Opened 9 years ago Closed 9 years ago

TI+JM: Assertion failure: Call site vanished., at ../methodjit/Compiler.cpp:2409

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: regression, Whiteboard: fixed-in-jaegermonkey)

--
function f() {
    gc();
    [].unshift(false);
}
f();
f();
--
$ ./js -m -n -a test.js
Assertion failure: Call site vanished., at ../methodjit/Compiler.cpp:2409
When recompiling to an uncached call, we emitted a place to rejoin from a scripted call but not from a native call.  This also fixes a second problem, which is that after purging inference info from a script we don't remember which call sites are monitored and this affected the behavior of the effectful Array natives.  This removes isTypeCallerMonitored and causes the Array natives to always record their side effects.  This could be fixed by bug 622302, calling specialized functions at sites where we know the inference data models the effects of the native.

http://hg.mozilla.org/projects/jaegermonkey/rev/2f248906118d
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
You need to log in before you can comment on or make changes to this bug.