648852 - TI: Assertion failure: Call site vanished., at ./methodjit/Retcon.cpp:112

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision d3215d1e985a (run with -m -n -a),
tested on 64 bit. Not sure if this is related to any of the previous call site asserts.

var toString = 1;
VERSION = "";
function startTest() {
    if (version) if (VERSION == "ECMA_1") {}
}
var VERSION = this;
startTest();

Comment 1

[Brian Hackett [Laid off!]]

Fixed I think by rev 3816e4abb158.  The problem was that for the '==' we generated an inlined version using a stub call (not generating equality ICs currently within inlined frames), and in the normal compiled version used the IC, and couldn't rejoin from one to the other when expanding inlined frames after '==' threw.

Rev 3816e4abb158 fixes this by generating a rejoin site at the '==' that jumps to the point where the stub's result is tested and can be used as a rejoin for any stub called by '=='.

Comment 2

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929