TI: Assertion failure: hasTypeBarriers(PC), at methodjit/Compiler.cpp:4879

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
--
critical
RESOLVED WORKSFORME
7 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

7 years ago
The following testcase asserts on TI revision f59a6cabfbd4 (run with -j -m -a -n), tested on 64 bit:


function printStatus(msg) {
    msg.toString()
    lines = msg
    for (var i = 0; i < lines;) i
}
var summary = new Float32Array;
try {
    printStatus(summary)
    x = {
    }
    toString.__proto__ = x
} catch (e) {}
var summary = 6;
printStatus(summary)
Subtle issue with how we handle mutable __proto__.  Kind of hard to pin down exactly what's wrong, the invariants around mutable __proto__ are a mess.  I know how to fix bug 656727 (in a way that gives perf benefits on scripts where we can't do much useful analysis of objects, like jslint) and will be doing that within the next couple days.
Depends on: 656727
Fixed as part of bug 670185, testcase included in that patch.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
(Reporter)

Updated

6 years ago
Blocks: 676763
(Reporter)

Comment 3

5 years ago
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug669706.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.