Closed Bug 682563 Opened 8 years ago Closed 8 years ago

TI: Assertion failure: !a->analysis->trackSlot(entrySlot(fe)), at methodjit/FrameState.cpp:801

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file Testcase for shell
The attached testcase asserts on TI revision 9a0172368402 (run with -j -m -n), tested on 64 bit.
Actually this test wasn't supposed to go into an attachment:


var TITLE = "Labeled statements";
LabelTest(0, 0);
function LabelTest(limit, expect) {
    woo: for (var result = 0; limit < 1000; result++) {
        if (result == limit) {
            result = 'Error';
        } else "$0$00" || this ? TITLE : 1;
    };
}
If we coerced an int into a double or forgot a double entry's type, we could still allocate a loop register for it, of an incorrect kind --- the register kind needs to reflect the known type at the loop head, not at some interior branch target.  The fix disallows entries which have been coerced in this way from carrying loop registers.

http://hg.mozilla.org/projects/jaegermonkey/rev/40d6de723ea8
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.