Assertion failure: copied == 0, at ../methodjit/FrameEntry.h:179

RESOLVED FIXED in mozilla10

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla10
x86_64
Linux
assertion, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following test asserts on mozilla-central revision fecae145d884 (options -m -n -a):


function foo(x) {
  x === x--;
}
foo(1.2);
(Assignee)

Comment 1

6 years ago
Created attachment 563800 [details] [diff] [review]
patch

Bogus assert.  There's a special path we take when code like 'x === x' shows up to test for NaN.  It needs normal registers, and if the entry is a known double we forget that so we can get the registers (probably generating some pretty bad code; this path hasn't been updated for TI).  The botch happens when we forget the lhs is a double, the fix pops the rhs first (it is no longer needed) so the lhs is not copied.
Assignee: general → bhackett1024
Attachment #563800 - Flags: review?(dvander)
(Assignee)

Updated

6 years ago
Whiteboard: js-triage-needed
Attachment #563800 - Flags: review?(dvander) → review+
(Assignee)

Comment 2

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/db349edef0d6
https://hg.mozilla.org/mozilla-central/rev/db349edef0d6
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla10
(Reporter)

Comment 4

4 years ago
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.