Closed Bug 673731 Opened 8 years ago Closed 8 years ago

TI: Assertion failure: cs->format & (JOF_INC | JOF_DEC), at jsemit.cpp:2977

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

The following testcase asserts on TI revision 9b9fd467eb5f (run with -j -m -n), tested on 64 bit:


const IS_TOKEN_ARRAY = [ printBugNumber && IS_TOKEN_ARRAY++ && this() ? this() : this() ];
Blocks: 647624
Some more code in the emitter which was not being covered by any tests whatsoever.  If the emitter sees an INCNAME which definitely resolves to a 'const' variable, it morphs that INCNAME into a NAME/GETGNAME and then emits a partially decomposed version of the rest of the op later on in another function.

I don't know what the point of this code is.  I don't think it's correctness as the emitter won't always be able to resolve an INCNAME on a const to that const ('with' etc.)

http://hg.mozilla.org/projects/jaegermonkey/rev/5ba8d207d7f3
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Blocks: 676763
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug673731.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.