[Chunk Patch] Assertion failure: array, at ../jsanalyze.h:1016

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: decoder, Assigned: bhackett)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Other Branch
x86
Linux
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
The following test asserts on mozilla-central f3c943d2e763 with chunk patch (bug 706914) (options -m -a (!)):


mjitChunkLimit(5);
var g = newGlobal('new-compartment');
g.eval("function f() {\n" +
       "    for (var i = 0; i <= N; i++)\n" +
       "        log += 'L';\n" +
       "}\n");
g.f();


The minimized version had code in it that disabled the type inference using options(), that is why this test must be run with -m -a only. The original test can't have used options() to disable TI because options() is a no-op in the unminimized driver.
(Assignee)

Comment 1

6 years ago
Chunk compilation shouldn't be performed when type inference is off (since no recompilation will be necessary).  Fixed in the latest bug 706914 patch.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.