Last Comment Bug 684576 - Assertion failure: !fe->data.inRegister(), at methodjit/FrameState-inl.h:977
: Assertion failure: !fe->data.inRegister(), at methodjit/FrameState-inl.h:977
: assertion, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
-- critical (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
: 684789 (view as bug list)
Depends on:
Blocks: langfuzz
  Show dependency treegraph
Reported: 2011-09-04 04:56 PDT by Christian Holler (:decoder)
Modified: 2013-01-14 07:59 PST (History)
6 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image Christian Holler (:decoder) 2011-09-04 04:56:05 PDT
The following test asserts on mozilla-central revision a351ae35f2c4 (options -m -n -a):

function f0(p0,p1) {
    var v3;
    do {
        p1 > v3
    } while (((p0[p1][5]==1)||(p0[p1][5]==2)||(p0[p1][5] == 3)) + 0 > p0);
    + (v3(f0));

Note: The specified mozilla-central revision had a build problem with standalone shell, patch from fixes this.
Comment 1 User image Brian Hackett (:bhackett) 2011-09-05 17:35:19 PDT
Wrong test used when identifying entries whose type weakens from double to unknown on a branch, and need to be reset if used to hold a GP reg on the branch.  The frame entry itself was tested, rather than the known type information shadowing the frame entry, and the frame entry is not required to reflect that known type.  Before branching to a bytecode where the entry was in a GP reg, that reg was loaded for the entry's payload but not forgotten after the branch finished.
Comment 2 User image Jan de Mooij [:jandem] 2011-09-06 07:05:11 PDT
*** Bug 684789 has been marked as a duplicate of this bug. ***
Comment 3 User image Boris Zbarsky [:bz] (still a bit busy) 2011-09-06 08:21:33 PDT
Requesting tracking for Firefox 9 to make sure we merge this to m-c, since otherwise bug 684789 is a problem.
Comment 4 User image Brian Hackett (:bhackett) 2011-09-06 22:38:09 PDT
Comment 5 User image Christian Holler (:decoder) 2013-01-14 07:59:09 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug684576.js.

Note You need to log in before you can comment on or make changes to this bug.