Closed Bug 660002 Opened 9 years ago Closed 9 years ago

TI: "Assertion failure: copied == 0,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, regression, testcase)

Attachments

(1 file)

Attached file stack
(function() {
    let V = x(x, x = w), x
})()

asserts js debug shell on JM changeset 8bcb569c9bf9 with -m, -a and -n at Assertion failure: copied == 0,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   69535:9e0bab2c04b4
user:        Brian Hackett
date:        Sat May 14 10:30:03 2011 -0700
summary:     [INFER] Don't learn types for dead entries at join points, bug 656591, learn argument types at script entry and mark monitored call ICs, bug 656920.
See bug 659438.
To simplify handling of most ops which expect objects, we forget information about the incoming stack values if they are known non-objects.  This broke invariants if the stack value was copied by other stack values popped in the opcode, we need to uncopy first in such cases.

http://hg.mozilla.org/projects/jaegermonkey/rev/e62ab4bbe727
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug660002.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.