TI: Assertion failure: !a->analysis->trackSlot(entrySlot(fe)), at methodjit/FrameState.cpp:801

RESOLVED FIXED

Status

()

--
critical
RESOLVED FIXED
7 years ago
6 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

Trunk
x86_64
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
Created attachment 556259 [details]
Testcase for shell

The attached testcase asserts on TI revision 9a0172368402 (run with -j -m -n), tested on 64 bit.
(Reporter)

Comment 1

7 years ago
Actually this test wasn't supposed to go into an attachment:


var TITLE = "Labeled statements";
LabelTest(0, 0);
function LabelTest(limit, expect) {
    woo: for (var result = 0; limit < 1000; result++) {
        if (result == limit) {
            result = 'Error';
        } else "$0$00" || this ? TITLE : 1;
    };
}
If we coerced an int into a double or forgot a double entry's type, we could still allocate a loop register for it, of an incorrect kind --- the register kind needs to reflect the known type at the loop head, not at some interior branch target.  The fix disallows entries which have been coerced in this way from carrying loop registers.

http://hg.mozilla.org/projects/jaegermonkey/rev/40d6de723ea8
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
(Reporter)

Comment 3

6 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.