JM: Assertion failure: length <= JS_ARGS_LENGTH_MAX, at ./methodjit/MonoIC.cpp:1209

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: luke)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following testcase asserts on TI revision 09cce9915b80 (run with -m -n -a),
tested on 64 bit:

function g(a, b, c, d) {}
function f(a, b, c) {
        arguments.length=8.64e15;
        g.apply(this, arguments);
}f();
This asserts also on the tracemonkey branch with -m -a at revision e2843f43757e.
No longer blocks: 619415
Summary: TI: Assertion failure: length <= JS_ARGS_LENGTH_MAX, at ./methodjit/MonoIC.cpp:1209 → JM: Assertion failure: length <= JS_ARGS_LENGTH_MAX, at ./methodjit/MonoIC.cpp:1209
(Assignee)

Updated

6 years ago
Assignee: general → luke
(Assignee)

Comment 2

6 years ago
Created attachment 529338 [details] [diff] [review]
fix

Oh jeez, lame bug.  I think this assert survived from a previous bug where we were erroneously using getArgsInitialLength (where the assert would hold).

Great find!
Attachment #529338 - Flags: review?(jwalden+bmo)
Attachment #529338 - Flags: review?(jwalden+bmo) → review+
(Assignee)

Comment 3

6 years ago
http://hg.mozilla.org/tracemonkey/rev/6bacbf7d220b
Whiteboard: fixed-in-tracemonkey
cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/6bacbf7d220b
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
Blocks: 676763
(Reporter)

Comment 5

4 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug653396.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.