As a security precaution, we have turned on the setting "Require API key authentication for API requests" for everyone. If this has broken something, please contact
Last Comment Bug 659438 - TI+JM: Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180
: TI+JM: Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: infer-regress
  Show dependency treegraph
Reported: 2011-05-24 14:04 PDT by Jan de Mooij [:jandem]
Modified: 2011-05-26 20:32 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image Jan de Mooij [:jandem] 2011-05-24 14:04:08 PDT
var o1 = {x: {}};
function f() {
    var o = o1;
    for(var i=0; i<10; i++) {
        o1 = o.x;
$ ./js -a -n -m test.js
Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180

Revision 29f08848d96c, 32-bit OS X.
Comment 1 User image Christian Holler (:decoder) 2011-05-25 07:58:07 PDT
Got this as well, testcase here is slightly easier:

function test() {
  var N = 16;
  do { N(1, N++); } while(false);
Comment 2 User image Brian Hackett (:bhackett) 2011-05-25 11:09:09 PDT
Broke copy invariants in storeTop related to temporaries, allowing a temporary to be marked as a copy of a local variable and stack slot.  Temporaries should never be copies of other entries.
Comment 3 User image Brian Hackett (:bhackett) 2011-05-25 11:10:21 PDT
Oops, the second testcase still breaks (same assert, different bug).
Comment 4 User image Gary Kwong [:gkw] [:nth10sd] 2011-05-26 10:23:01 PDT
See bug 660002.
Comment 5 User image Brian Hackett (:bhackett) 2011-05-26 20:32:48 PDT
Second testcase works now with rev e62ab4bbe727 (bug 660002 patch).

Note You need to log in before you can comment on or make changes to this bug.