653249 - TI: Assertion failure: backing->data.inMemory() && backing != fe, at ./methodjit/FrameState-inl.h:666

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision 09cce9915b80 (run with -m -n -a),
tested on 64 bit:

function testUnaryImacros() {
    function checkArg(x) {
        o = {
            valueOf: checkArg
        }
    }
    var v = 0;
    v += +toString;
    for (var i = 0; i;) {
        v += [].checkArg.checkArg;
    }
}(testUnaryImacros(), "valueOf passed, toString passed");

Comment 2

[Brian Hackett [Laid off!]]

Obscure case when the compiler is manipulating a variable with an empty type set (causing it to be treated as unknown), which is merged into an SSA phi node with double type (due to other possible values for the variable which are definitely doubles).  We can just coerce such unknown variables into doubles before branching, without needing to revert them afterwards as for int->double branching (any code manipulating values with empty type sets will never actually run).

http://hg.mozilla.org/projects/jaegermonkey/rev/e0d5de48aafb

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug653249.js.