651147 - TI: Assertion failure: fe <= top, at ./methodjit/ImmutableSync.cpp:152

Status: RESOLVED FIXED

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision d78eef12a329 (run with -m -n -a),
tested on 32 bit:

var BUGNUMBER = 96284;
var BUGNUMBER = "410725";
function iteratorToArray(iterator) {
    var result = [];
    for (var i in iterator) BUGNUMBER[result.length];
}
obj = { a: 1, }('["a", "b"]', iteratorToArray(), 'uneval(iteratorToArray(new Iterator(obj,true)))');

Comment 1

[Brian Hackett (:bhackett)]

Bogus assertion in ImmutableSync, which should be able to manage copies of loop temporaries in the same way as other copies.

http://hg.mozilla.org/projects/jaegermonkey/rev/3538d4d61e0e

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug651147.js.