Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:180

RESOLVED FIXED in mozilla9

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla9
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following test assert on mozilla-central revision 06445f55f009 (options -m -n -a):


if (!this.emulatedJSON) {
    emulatedJSON = function () {
        function stringify(value, whitelist) {
            var a, i, v;
            switch (typeof value) {
            case 'string':
                if (!(value.propertyIsEnumerable('length'))) {
                    for (i = 0; i < l; i += 1) {
                        k = whitelist[i];
                        if (typeof k === 'string') {
                            if (i %= 'not visited') {}
                        }
                    }
                }
            }
        }
        return {
            stringify: stringify,
        };
    }();
    var testPairs = [ ['{"five":5}'] ]
    for (var i = 0; i < testPairs.length; i++) {
        var pair = testPairs[i];
        var s = emulatedJSON.stringify(pair[1])
    }
}
(Assignee)

Comment 1

6 years ago
Created attachment 561974 [details] [diff] [review]
patch

Bogus assertion.  In scripts which have switch or try blocks we don't track variables using the SSA and need to forget about known doubles when branching to a location where the slot is in a normal register (with SSA this is done in the compiler rather than frame state).  To mark the type as unknown, fe->resetSynced was used, which only wants to be called on non-copied frame entries.  A copy is possible here, so the fix just explicitly marks the type/data of the entry as in memory.
Attachment #561974 - Flags: review?(dvander)
(Assignee)

Updated

6 years ago
Whiteboard: js-triage-needed
Attachment #561974 - Attachment is patch: true
Attachment #561974 - Flags: review?(dvander) → review+
(Assignee)

Comment 2

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/65d1dc5881f0

Comment 3

6 years ago
https://hg.mozilla.org/mozilla-central/rev/65d1dc5881f0
Assignee: general → bhackett1024
Status: NEW → RESOLVED
Last Resolved: 6 years ago
OS: Linux → All
Hardware: x86 → All
Resolution: --- → FIXED
Target Milestone: --- → mozilla9
(Reporter)

Comment 4

4 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.