The default bug view has changed. See this FAQ.

TI+JM: Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Unassigned)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
--
var o1 = {x: {}};
function f() {
    var o = o1;
    for(var i=0; i<10; i++) {
        o1 = o.x;
    }
}
f();
--
$ ./js -a -n -m test.js
Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180

Revision 29f08848d96c, 32-bit OS X.
Got this as well, testcase here is slightly easier:

test();
function test() {
  var N = 16;
  do { N(1, N++); } while(false);
}
Broke copy invariants in storeTop related to temporaries, allowing a temporary to be marked as a copy of a local variable and stack slot.  Temporaries should never be copies of other entries.

http://hg.mozilla.org/projects/jaegermonkey/rev/7ae647fe972f
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Oops, the second testcase still breaks (same assert, different bug).
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
See bug 660002.
Second testcase works now with rev e62ab4bbe727 (bug 660002 patch).
Status: REOPENED → RESOLVED
Last Resolved: 6 years ago6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.