647440 - TI+JM: Assertion failure: !isEntryCopied(fe), at ../methodjit/FrameState-inl.h:878

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
if (false) 
    function g() {}
function f() {
    var x;
    (x = Infinity) >> x--;
}
f();
--
$ ./js -m -n -a test.js
Assertion failure: !isEntryCopied(fe), at ../methodjit/FrameState-inl.h:878

Comment 1

[Brian Hackett [Laid off!]]

When doing a bitwise op we need to make sure the operands are not copies of one another (they can both be copies of a third thing, but I didn't think it was possible that the rhs could directly copy the lhs).

http://hg.mozilla.org/projects/jaegermonkey/rev/74201cda4ce3