Closed Bug 657304 Opened 9 years ago Closed 9 years ago

TI: Assertion failure: !fe->data.inRegister(), at methodjit/FrameState-inl.h:922

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

The attached testcase asserts on TI revision 693a36f402ee (unpack, chdir and run main.js with -m -n -a), tested on 64 bit.
If we did a syncAndForgetEverything within a basic block, we would forget which args and locals are definitely doubles and could load them into normal registers if they are subsequently accessed.  It makes more sense to establish the correspondence between inferred and FrameState types of entries when the entries are accessed, not at join points.

http://hg.mozilla.org/projects/jaegermonkey/rev/0cd135eb71a3
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Blocks: 676763
You need to log in before you can comment on or make changes to this bug.