TI: "Assertion failure: copied == 0,"

RESOLVED FIXED

Status

()

--
critical
RESOLVED FIXED
7 years ago
6 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, regression, testcase})

Trunk
x86
Mac OS X
assertion, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

Created attachment 535387 [details]
stack

(function() {
    let V = x(x, x = w), x
})()

asserts js debug shell on JM changeset 8bcb569c9bf9 with -m, -a and -n at Assertion failure: copied == 0,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   69535:9e0bab2c04b4
user:        Brian Hackett
date:        Sat May 14 10:30:03 2011 -0700
summary:     [INFER] Don't learn types for dead entries at join points, bug 656591, learn argument types at script entry and mark monitored call ICs, bug 656920.
To simplify handling of most ops which expect objects, we forget information about the incoming stack values if they are known non-objects.  This broke invariants if the stack value was copied by other stack values popped in the opcode, we need to uncopy first in such cases.

http://hg.mozilla.org/projects/jaegermonkey/rev/e62ab4bbe727
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug660002.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.