TI: Assertion failure: frame.stackDepth() == opinfo->stackDepth, at ./methodjit/Compiler.cpp:1108

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: decoder, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
The following code asserts on TI tip (run with -n -m -a, tested on 64 bit):

new TestCase( SECTION, "valof=Boolean.prototype.valueOf; x=new Boolean(true); x.valueOf=valof;x.valueOf()", true, name++ % ++ undefined% 
 NaN+ get(__noSuchMethod__) );
(Assignee)

Comment 1

7 years ago
Created attachment 522358 [details] [diff] [review]
Patch

Propagate jsop_binary overflow for remaining inc/dec ops. This fixes all jsop_binary calls. I'm not too happy about the use of CompileStatus but we have to return both error and overflow.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #522358 - Flags: review?(bhackett1024)
(Assignee)

Updated

7 years ago
Duplicate of this bug: 645293
Attachment #522358 - Flags: review?(bhackett1024) → review+
http://hg.mozilla.org/projects/jaegermonkey/rev/60a4769fe844
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
(Reporter)

Updated

7 years ago
Blocks: 676763
You need to log in before you can comment on or make changes to this bug.