Last Comment Bug 657304 - TI: Assertion failure: !fe->data.inRegister(), at methodjit/FrameState-inl.h:922
: TI: Assertion failure: !fe->data.inRegister(), at methodjit/FrameState-inl.h:922
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress langfuzz
  Show dependency treegraph
 
Reported: 2011-05-16 01:56 PDT by Christian Holler (:decoder)
Modified: 2011-08-05 00:54 PDT (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
shell testcase, unpack, chdir and run main.js with options "-n -m -a" (813 bytes, application/x-compressed-tar)
2011-05-16 01:56 PDT, Christian Holler (:decoder)
no flags Details

Description Christian Holler (:decoder) 2011-05-16 01:56:09 PDT
Created attachment 532582 [details]
shell testcase, unpack, chdir and run main.js with options "-n -m -a"

The attached testcase asserts on TI revision 693a36f402ee (unpack, chdir and run main.js with -m -n -a), tested on 64 bit.
Comment 1 Brian Hackett (:bhackett) 2011-05-16 10:27:01 PDT
If we did a syncAndForgetEverything within a basic block, we would forget which args and locals are definitely doubles and could load them into normal registers if they are subsequently accessed.  It makes more sense to establish the correspondence between inferred and FrameState types of entries when the entries are accessed, not at join points.

http://hg.mozilla.org/projects/jaegermonkey/rev/0cd135eb71a3

Note You need to log in before you can comment on or make changes to this bug.