Last Comment Bug 659438 - TI+JM: Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180
: TI+JM: Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-05-24 14:04 PDT by Jan de Mooij [:jandem]
Modified: 2011-05-26 20:32 PDT (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Jan de Mooij [:jandem] 2011-05-24 14:04:08 PDT
--
var o1 = {x: {}};
function f() {
    var o = o1;
    for(var i=0; i<10; i++) {
        o1 = o.x;
    }
}
f();
--
$ ./js -a -n -m test.js
Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180

Revision 29f08848d96c, 32-bit OS X.
Comment 1 Christian Holler (:decoder) 2011-05-25 07:58:07 PDT
Got this as well, testcase here is slightly easier:

test();
function test() {
  var N = 16;
  do { N(1, N++); } while(false);
}
Comment 2 Brian Hackett (:bhackett) 2011-05-25 11:09:09 PDT
Broke copy invariants in storeTop related to temporaries, allowing a temporary to be marked as a copy of a local variable and stack slot.  Temporaries should never be copies of other entries.

http://hg.mozilla.org/projects/jaegermonkey/rev/7ae647fe972f
Comment 3 Brian Hackett (:bhackett) 2011-05-25 11:10:21 PDT
Oops, the second testcase still breaks (same assert, different bug).
Comment 4 Gary Kwong [:gkw] [:nth10sd] 2011-05-26 10:23:01 PDT
See bug 660002.
Comment 5 Brian Hackett (:bhackett) 2011-05-26 20:32:48 PDT
Second testcase works now with rev e62ab4bbe727 (bug 660002 patch).

Note You need to log in before you can comment on or make changes to this bug.