660203 - TI: Assertion failure: js_GetOpcode(cx, f.script(), f.pc()) == JSOP_LENGTH, at methodjit/StubCalls.cpp:1981

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision 1252c464553e (run with -j -m -a -n), tested on 64 bit:


function throwsRangeError(t) {
    try {
        var date = arguments;
        date.setTime
    } catch (err) {
    }
}
throwsRangeError();

Comment 1

[Brian Hackett [Laid off!]]

For the arguments escape analysis we were trying to track slots in scripts with try/switch blocks, which we can't do.  Needed to use trackSlot instead of slotEscapes.  This also adds an assert to make the failure happen earlier (also want to eventually merge trackSlot and slotEscapes together).

http://hg.mozilla.org/projects/jaegermonkey/rev/2330107aa0af

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug660203.js.