TI: Assertion failure: newShape != initialShape, at methodjit/PolyIC.cpp:384

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
7 years ago
5 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
Created attachment 554757 [details]
Testcase for shell

The attached testcase asserts on TI revision a2bbe9c999b4 (run with -j -m -n -Z 2), tested on 64 bit.
Code-discard hazard introduced by potential GCs with addProperty, during ADDPROP PIC stub generation.  This call used to not be a problem since it can't trigger recompilation, but now that we discard code during GC it is problematic.  (Another vote for refactoring the ICs to split VM and IC operations into two phases).

http://hg.mozilla.org/projects/jaegermonkey/rev/c685e6d17745
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
(Reporter)

Comment 2

5 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.