Closed Bug 688968 Opened 8 years ago Closed 8 years ago

Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:179

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla10

People

(Reporter: decoder, Assigned: bhackett1024)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

The following test asserts on mozilla-central revision fecae145d884 (options -m -n -a):


function foo(x) {
  x === x--;
}
foo(1.2);
Attached patch patchSplinter Review
Bogus assert.  There's a special path we take when code like 'x === x' shows up to test for NaN.  It needs normal registers, and if the entry is a known double we forget that so we can get the registers (probably generating some pretty bad code; this path hasn't been updated for TI).  The botch happens when we forget the lhs is a double, the fix pops the rhs first (it is no longer needed) so the lhs is not copied.
Assignee: general → bhackett1024
Attachment #563800 - Flags: review?(dvander)
Whiteboard: js-triage-needed
Attachment #563800 - Flags: review?(dvander) → review+
https://hg.mozilla.org/mozilla-central/rev/db349edef0d6
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla10
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.