Last Comment Bug 651147 - TI: Assertion failure: fe <= top, at ./methodjit/ImmutableSync.cpp:152
: TI: Assertion failure: fe <= top, at ./methodjit/ImmutableSync.cpp:152
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress langfuzz
  Show dependency treegraph
 
Reported: 2011-04-19 08:44 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 08:15 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Christian Holler (:decoder) 2011-04-19 08:44:30 PDT
The following testcase asserts on TI revision d78eef12a329 (run with -m -n -a),
tested on 32 bit:

var BUGNUMBER = 96284;
var BUGNUMBER = "410725";
function iteratorToArray(iterator) {
    var result = [];
    for (var i in iterator) BUGNUMBER[result.length];
}
obj = { a: 1, }('["a", "b"]', iteratorToArray(), 'uneval(iteratorToArray(new Iterator(obj,true)))');
Comment 1 Brian Hackett (:bhackett) 2011-04-19 22:57:42 PDT
Bogus assertion in ImmutableSync, which should be able to manage copies of loop temporaries in the same way as other copies.

http://hg.mozilla.org/projects/jaegermonkey/rev/3538d4d61e0e
Comment 2 Christian Holler (:decoder) 2013-01-14 08:15:57 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug651147.js.

Note You need to log in before you can comment on or make changes to this bug.