Closed Bug 653396 Opened 9 years ago Closed 9 years ago

JM: Assertion failure: length <= JS_ARGS_LENGTH_MAX, at ./methodjit/MonoIC.cpp:1209

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: luke)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

The following testcase asserts on TI revision 09cce9915b80 (run with -m -n -a),
tested on 64 bit:

function g(a, b, c, d) {}
function f(a, b, c) {
        arguments.length=8.64e15;
        g.apply(this, arguments);
}f();
This asserts also on the tracemonkey branch with -m -a at revision e2843f43757e.
No longer blocks: infer-regress
Summary: TI: Assertion failure: length <= JS_ARGS_LENGTH_MAX, at ./methodjit/MonoIC.cpp:1209 → JM: Assertion failure: length <= JS_ARGS_LENGTH_MAX, at ./methodjit/MonoIC.cpp:1209
Assignee: general → luke
Attached patch fixSplinter Review
Oh jeez, lame bug.  I think this assert survived from a previous bug where we were erroneously using getArgsInitialLength (where the assert would hold).

Great find!
Attachment #529338 - Flags: review?(jwalden+bmo)
Attachment #529338 - Flags: review?(jwalden+bmo) → review+
http://hg.mozilla.org/tracemonkey/rev/6bacbf7d220b
Whiteboard: fixed-in-tracemonkey
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Blocks: 676763
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/testBug653396.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.