Closed Bug 647547 Opened 9 years ago Closed 9 years ago

TI: Assertion failure: kind == NAME || kind == XNAME, at ./methodjit/PolyIC.h:530

Categories

(Core :: JavaScript Engine, defect, critical)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase) 

The following code asserts on TI tip (run with -n -m -a), tested on 64 bit:

DoWhile(new DoWhileObject);
new DoWhileObject("", Boolean);
function DoWhileObject( d, e, s ) {
  this.whileExpression=e;
}
function DoWhile( object ) {
  while ( object.whileExpression ) eval(  );
  Boolean  
}
Duplicate of this bug: 647435
Corruption during IC processing because js_FindProperty triggered recompilation.

http://hg.mozilla.org/projects/jaegermonkey/rev/8c6e7d8864d7
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Blocks: 676763
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/recompile/bug647547.js.
Flags: in-testsuite+
Depends on: 936802
You need to log in before you can comment on or make changes to this bug.