TI+JM: Assertion failure: location_ != PhysLoc_Invalid, at ../methodjit/RematInfo.h:279

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: jandem, Unassigned)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

7 years ago
--
function f(x, y) {
    return x;
}
var a = 3.3;
a ? f(f(1, 2), 3) : a;
--
$ ./js -a -n -m test.js
Assertion failure: location_ != PhysLoc_Invalid, at ../methodjit/RematInfo.h:279

Revision a9f916668b29, does not assert with a build from yesterday.
Yeah, the LICM patch yesterday added several of these assertions making sure we don't use invalid frame entries.  When coercing an entry to a double which is a copy of something else, we would directly look at the entries contents even if it was a copy of something else.  I don't know if this case could actually manifest in problems, but it is misuse and these assertions are good for catching lots of behaviors that actually are errors (accessing entries not on the stack, for example).

http://hg.mozilla.org/projects/jaegermonkey/rev/4778158a32e6
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.