TI: Assertion failure: !fe->data.inRegister(), at methodjit/FrameState-inl.h:922

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 532582 [details]
shell testcase, unpack, chdir and run main.js with options "-n -m -a"

The attached testcase asserts on TI revision 693a36f402ee (unpack, chdir and run main.js with -m -n -a), tested on 64 bit.
If we did a syncAndForgetEverything within a basic block, we would forget which args and locals are definitely doubles and could load them into normal registers if they are subsequently accessed.  It makes more sense to establish the correspondence between inferred and FrameState types of entries when the entries are accessed, not at join points.

http://hg.mozilla.org/projects/jaegermonkey/rev/0cd135eb71a3
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Reporter)

Updated

6 years ago
Blocks: 676763
You need to log in before you can comment on or make changes to this bug.