TI: Assertion failure: backing->data.inMemory() && backing != fe, at ./methodjit/FrameState-inl.h:666

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
The following testcase asserts on TI revision 09cce9915b80 (run with -m -n -a),
tested on 64 bit:

function testUnaryImacros() {
    function checkArg(x) {
        o = {
            valueOf: checkArg
        }
    }
    var v = 0;
    v += +toString;
    for (var i = 0; i;) {
        v += [].checkArg.checkArg;
    }
}(testUnaryImacros(), "valueOf passed, toString passed");
Duplicate of this bug: 653400
Obscure case when the compiler is manipulating a variable with an empty type set (causing it to be treated as unknown), which is merged into an SSA phi node with double type (due to other possible values for the variable which are definitely doubles).  We can just coerce such unknown variables into doubles before branching, without needing to revert them afterwards as for int->double branching (any code manipulating values with empty type sets will never actually run).

http://hg.mozilla.org/projects/jaegermonkey/rev/e0d5de48aafb
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
Blocks: 676763
(Reporter)

Comment 3

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug653249.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.