638977 - TI+JM: Assertion failure: Call site vanished., at ../methodjit/Compiler.cpp:2409

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f() {
    gc();
    [].unshift(false);
}
f();
f();
--
$ ./js -m -n -a test.js
Assertion failure: Call site vanished., at ../methodjit/Compiler.cpp:2409

Comment 1

[Brian Hackett [Laid off!]]

When recompiling to an uncached call, we emitted a place to rejoin from a scripted call but not from a native call.  This also fixes a second problem, which is that after purging inference info from a script we don't remember which call sites are monitored and this affected the behavior of the effectful Array natives.  This removes isTypeCallerMonitored and causes the Array natives to always record their side effects.  This could be fixed by bug 622302, calling specialized functions at sites where we know the inference data models the effects of the native.

http://hg.mozilla.org/projects/jaegermonkey/rev/2f248906118d