Closed Bug 673767 Opened 9 years ago Closed 9 years ago

TI: Assertion failure: index < script()->nTypeSets, at ./jsinferinlines.h:503

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

The following testcase asserts on TI revision 9b9fd467eb5f (run with -j -m -n), tested on 64 bit:


var stack = { push: [].push };
stack.length += Math.pow(2, 37);
Adding -a to options makes this test fail with a different assertion:

Assertion failure: stackDepth >= nuses, at jsanalyze.cpp:474
Duplicate of this bug: 673769
Duplicate of this bug: 673776
Merge botch, we were emitting malformed bytecode around certain JSOP_LENGTH opcodes.

http://hg.mozilla.org/projects/jaegermonkey/rev/bdf006d7b67d
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug673767.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.