Closed Bug 648498 Opened 9 years ago Closed 9 years ago

TI+JM: Assertion failure: location_ != PhysLoc_Invalid, at ../methodjit/RematInfo.h:279

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

--
function f(x, y) {
    return x;
}
var a = 3.3;
a ? f(f(1, 2), 3) : a;
--
$ ./js -a -n -m test.js
Assertion failure: location_ != PhysLoc_Invalid, at ../methodjit/RematInfo.h:279

Revision a9f916668b29, does not assert with a build from yesterday.
Yeah, the LICM patch yesterday added several of these assertions making sure we don't use invalid frame entries.  When coercing an entry to a double which is a copy of something else, we would directly look at the entries contents even if it was a copy of something else.  I don't know if this case could actually manifest in problems, but it is misuse and these assertions are good for catching lots of behaviors that actually are errors (accessing entries not on the stack, for example).

http://hg.mozilla.org/projects/jaegermonkey/rev/4778158a32e6
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.