648498 - TI+JM: Assertion failure: location_ != PhysLoc_Invalid, at ../methodjit/RematInfo.h:279

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f(x, y) {
    return x;
}
var a = 3.3;
a ? f(f(1, 2), 3) : a;
--
$ ./js -a -n -m test.js
Assertion failure: location_ != PhysLoc_Invalid, at ../methodjit/RematInfo.h:279

Revision a9f916668b29, does not assert with a build from yesterday.

Comment 1

[Brian Hackett [Laid off!]]

Yeah, the LICM patch yesterday added several of these assertions making sure we don't use invalid frame entries.  When coercing an entry to a double which is a copy of something else, we would directly look at the entries contents even if it was a copy of something else.  I don't know if this case could actually manifest in problems, but it is misuse and these assertions are good for catching lots of behaviors that actually are errors (accessing entries not on the stack, for example).

http://hg.mozilla.org/projects/jaegermonkey/rev/4778158a32e6