The default bug view has changed. See this FAQ.

TI: Assertion failure: !fe->isConstant(), at ./methodjit/FrameState-inl.h:510

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
The following testcase asserts on TI revision ac0989a03bf1 (run with options -m -a -n), tested on 32 bit:

AddRegExpCases(/a*b/, "xxx", 0, null );
AddRegExpCases(/x\d\dy/, "abcx45ysss235", 3,[] );
function AddRegExpCases(regexp, pattern, index, matches_array ) 
        (matches_array.length, regexp)
This is the same basic issue as bug 650662, but exposed an additional problem that when emitting code for JSOP_LENGTH we don't always include rejoin points for calls associated with JSOP_GETPROP (which LENGTH is sometimes but not always implemented in terms using).

http://hg.mozilla.org/projects/jaegermonkey/rev/0178e1b19f45
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
Blocks: 676763
(Reporter)

Comment 2

4 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.