646495 - TI+JM: Assertion failure: !fe->type.isConstant(), at ../methodjit/FrameState-inl.h:484

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f() {
    var x = 1;
    var y;
    if (x = y = Math) {}
}
f();
--
$ ./js -a -n -m test.js
Assertion failure: !fe->type.isConstant(), at ../methodjit/FrameState-inl.h:484

Comment 1

[Brian Hackett [Laid off!]]

There is a FrameState invariant that if an entry is a copy of another entry, the two have the same type (this patch adds appropriate assertions to assertValidRegisterState).  In a couple places while making copies, we can learn types for the copied entry (i.e. y is inferred as an int and a copy of x, so x must also be an int), but did not fixup existing copies of the copied entry.

http://hg.mozilla.org/projects/jaegermonkey/rev/2c9b41f384ea

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Maybe it would be better for copies to grab their type information from the backing FE?

Comment 4

[Brian Hackett [Laid off!]]

I think so, yeah.  Would that be better applied to TM and then merged back?

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Yeah that seems like it would reduce a bunch of complexity. There are other areas of code that take care to propagate the type when copying which is gross.

Comment 6

[Brian Hackett [Laid off!]]

As part of bug 618692, I made this change in the JM branch and beefed up frame state/entry assertions so that all entries which are not on the stack or are not active temporaries are invalidated and it is an error to use them (found a few places where we popped entries off the stack and continued to query them).