Closed Bug 659438 Opened 9 years ago Closed 9 years ago

TI+JM: Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

--
var o1 = {x: {}};
function f() {
    var o = o1;
    for(var i=0; i<10; i++) {
        o1 = o.x;
    }
}
f();
--
$ ./js -a -n -m test.js
Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180

Revision 29f08848d96c, 32-bit OS X.
Got this as well, testcase here is slightly easier:

test();
function test() {
  var N = 16;
  do { N(1, N++); } while(false);
}
Broke copy invariants in storeTop related to temporaries, allowing a temporary to be marked as a copy of a local variable and stack slot.  Temporaries should never be copies of other entries.

http://hg.mozilla.org/projects/jaegermonkey/rev/7ae647fe972f
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Oops, the second testcase still breaks (same assert, different bug).
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Second testcase works now with rev e62ab4bbe727 (bug 660002 patch).
Status: REOPENED → RESOLVED
Closed: 9 years ago9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.