Closed Bug 672122 Opened 9 years ago Closed 9 years ago

TI: "Assertion failure: stackDepth == newDepth,"

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

if (x) {} else if ((evalcx('lazy'))++) {}

asserts js debug shell on JM changeset 7f471e15146e with -m and -a at Assertion failure: stackDepth == newDepth,
Attached file stack
For the ELEMINC ops emitted to help the decompiler in SETCALL situations, we emitted a dummy decomposed version of the op (it's dead code) but did not balance the stack between the original op and the decomposed version, as the method JIT requires.

http://hg.mozilla.org/projects/jaegermonkey/rev/b804df6e5d28
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug672122.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.