Closed Bug 644970 Opened 9 years ago Closed 9 years ago

TI: Assertion failure: frame.stackDepth() == opinfo->stackDepth, at ./methodjit/Compiler.cpp:1108

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: jandem)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

The following code asserts on TI tip (run with -n -m -a, tested on 64 bit):

new TestCase( SECTION, "valof=Boolean.prototype.valueOf; x=new Boolean(true); x.valueOf=valof;x.valueOf()", true, name++ % ++ undefined% 
 NaN+ get(__noSuchMethod__) );
Attached patch PatchSplinter Review
Propagate jsop_binary overflow for remaining inc/dec ops. This fixes all jsop_binary calls. I'm not too happy about the use of CompileStatus but we have to return both error and overflow.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #522358 - Flags: review?(bhackett1024)
Duplicate of this bug: 645293
Attachment #522358 - Flags: review?(bhackett1024) → review+
http://hg.mozilla.org/projects/jaegermonkey/rev/60a4769fe844
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Blocks: 676763
You need to log in before you can comment on or make changes to this bug.