659456 - TI: Assertion failure: !inline_, at methodjit/MethodJIT.cpp:1297

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision 29f08848d96c (run with -j -m -n -a), tested on 64 bit:


function foo() { return "tracejit,methodjit"; };
function baz(on) {
    foo('bar');
}
eval("\
test();\
function test() {\
  baz(true);\
  test();\
}\
");

Comment 1

[Brian Hackett [Laid off!]]

Oversight, need to handle computation of the parent pc/inlined in FixupArity when that parent is in an inlined frame.  Inlined frames can't have an argc mismatch, but they can certainly call functions with a mismatch.  Think this is a regression from rev f8159830d8b7, earlier we would always make a slow call here.

http://hg.mozilla.org/projects/jaegermonkey/rev/d5538f680ab4

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug659456.js.