647559 - TI: Assertion failure: (strBits >> JSVAL_TAG_SHIFT) == 0, at ../jsval.h:632

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following code asserts on TI tip (run with -m -n -a), tested on 64 bit:

var UBound = 0;
var actualvalues = [ ];
var expect= '';
var expectedvalues = [ ];
addThis();
Object.defineProperty(Object.prototype, "name",
{
  get: function() {this.nameGETS++ }
})
expectedvalues.name( actual );
function addThis() {
  expectedvalues[UBound] = expect.toString()
}


Testcase was not stable under minimization and switched asserts/crashed, I assume this is a memory corruption.

Comment 1

[Brian Hackett [Laid off!]]

Yeah, this is corruption from a use of the CALLPROP IC after it has been destroyed from a nested recompilation.  I could swear I've fixed this exact bug before, need to pay more attention during merges I think.

http://hg.mozilla.org/projects/jaegermonkey/rev/df76ed3fb875