659438 - TI+JM: Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
var o1 = {x: {}};
function f() {
    var o = o1;
    for(var i=0; i<10; i++) {
        o1 = o.x;
    }
}
f();
--
$ ./js -a -n -m test.js
Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180

Revision 29f08848d96c, 32-bit OS X.

Comment 1

[Christian Holler (:decoder)]

Got this as well, testcase here is slightly easier:

test();
function test() {
  var N = 16;
  do { N(1, N++); } while(false);
}

Comment 2

[Brian Hackett [Laid off!]]

Broke copy invariants in storeTop related to temporaries, allowing a temporary to be marked as a copy of a local variable and stack slot.  Temporaries should never be copies of other entries.

http://hg.mozilla.org/projects/jaegermonkey/rev/7ae647fe972f

Comment 3

[Brian Hackett [Laid off!]]

Oops, the second testcase still breaks (same assert, different bug).

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

See bug 660002.

Comment 5

[Brian Hackett [Laid off!]]

Second testcase works now with rev e62ab4bbe727 (bug 660002 patch).