Last Comment Bug 658801 - TI+JM: Assertion failure: !fe->isConstant(), at ../methodjit/FrameState-inl.h:537
: TI+JM: Assertion failure: !fe->isConstant(), at ../methodjit/FrameState-inl.h...
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
-- normal (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: infer-regress
  Show dependency treegraph
Reported: 2011-05-21 10:20 PDT by Jan de Mooij [:jandem]
Modified: 2011-05-21 22:51 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image Jan de Mooij [:jandem] 2011-05-21 10:20:13 PDT
function f1(o) {"x", f1);
function f2() {}
function f3() {}
for(var i=0; i<2; i++) {
$ ./js -m -a -n test.js
Assertion failure: !fe->isConstant(), at ../methodjit/FrameState-inl.h:537

Revision 33f1ad45ccb8, 32-bit OS X.
Comment 1 User image Brian Hackett (:bhackett) 2011-05-21 22:51:09 PDT
The new jsop_callprop_dispatch path did not handle a constant object at the top of the stack (man, I'll never get tired of making this mistake when writing new paths).

Note You need to log in before you can comment on or make changes to this bug.