677635 - TI: Assertion failure: v.isObject(), at jsnum.cpp:1362

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision bde71d2d88fb (run with -j -m -n -a), tested on 64 bit:


try {
  var index = 0;
} catch (e) {}
test();
function test() {
  try { 
        for(var [message,prettyPrinting]=[arguments,__lookupGetter__];
        message<index;
        [message,prettyPrinting]=[arguments,__lookupGetter__])gczeal(message);
  } catch(ex) {  } 
}

Comment 1

[Brian Hackett [Laid off!]]

The destructuring assignment here uses LOCAL opcodes to access values pushed by a previous ARGUMENTS opcode, which caused the SSA use chains to be incorrect and the arguments escape analysis to break.  These accesses aren't a problem for TI otherwise as they get marked with unknown type, but any analysis which depends on use chains needs to watch for scripts containing such accesses and behave pessimistically.

http://hg.mozilla.org/projects/jaegermonkey/rev/8a7510ed55aa

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug677635.js.