Closed
Bug 669706
Opened 13 years ago
Closed 13 years ago
TI: Assertion failure: hasTypeBarriers(PC), at methodjit/Compiler.cpp:4879
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: decoder, Unassigned)
References
Details
(Keywords: assertion, testcase)
The following testcase asserts on TI revision f59a6cabfbd4 (run with -j -m -a -n), tested on 64 bit: function printStatus(msg) { msg.toString() lines = msg for (var i = 0; i < lines;) i } var summary = new Float32Array; try { printStatus(summary) x = { } toString.__proto__ = x } catch (e) {} var summary = 6; printStatus(summary)
Comment 1•13 years ago
|
||
Subtle issue with how we handle mutable __proto__. Kind of hard to pin down exactly what's wrong, the invariants around mutable __proto__ are a mess. I know how to fix bug 656727 (in a way that gives perf benefits on scripts where we can't do much useful analysis of objects, like jslint) and will be doing that within the next couple days.
Depends on: 656727
Comment 2•13 years ago
|
||
Fixed as part of bug 670185, testcase included in that patch.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
Reporter | ||
Comment 3•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug669706.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•