678087 - TI: Assertion failure: pobj == found, at jsinterp.cpp:1594

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on TI revision 3cf701fb5962 (run with -j -m -n -a), tested on 64 bit:


out1:
for (i = 0; i < 1000; i++) {
    for (j = 0; j < 1000; j++) {
      if (j == 500) break out1;
    }
}
do {
with({
    TestCase: Float64Array
}) for each(let TestCase in [TestCase]) {}
} while (i < 1000);
function TestCase(n, d, e, a) {}

Comment 1

[Brian Hackett [Laid off!]]

This gives the same assertion on an m-c shell, with no CLI parameters.  Not a TI bug.

Comment 2

[Brian Hackett [Laid off!]]

Actually, I was using the wrong shell when testing this, it is a TI-only issue.  The assert here is bogus though, the problem was that when checking the correctness of a property cache hit on a GNAME opcode we did so as if it was a NAME opcode, and got confused if the GNAME was emitted incorrectly (as it can be, around uses of 'with').

http://hg.mozilla.org/projects/jaegermonkey/rev/0a8195cb7590

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug678087.js.