Closed Bug 678087 Opened 13 years ago Closed 13 years ago

TI: Assertion failure: pobj == found, at jsinterp.cpp:1594

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase)

The following testcase asserts on TI revision 3cf701fb5962 (run with -j -m -n -a), tested on 64 bit:


out1:
for (i = 0; i < 1000; i++) {
    for (j = 0; j < 1000; j++) {
      if (j == 500) break out1;
    }
}
do {
with({
    TestCase: Float64Array
}) for each(let TestCase in [TestCase]) {}
} while (i < 1000);
function TestCase(n, d, e, a) {}
This gives the same assertion on an m-c shell, with no CLI parameters.  Not a TI bug.
Actually, I was using the wrong shell when testing this, it is a TI-only issue.  The assert here is bogus though, the problem was that when checking the correctness of a property cache hit on a GNAME opcode we did so as if it was a NAME opcode, and got confused if the GNAME was emitted incorrectly (as it can be, around uses of 'with').

http://hg.mozilla.org/projects/jaegermonkey/rev/0a8195cb7590
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug678087.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.