712266 - [Chunk Patch] Assertion failure: array, at ../jsanalyze.h:1016

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test asserts on mozilla-central f3c943d2e763 with chunk patch (bug 706914) (options -m -a (!)):


mjitChunkLimit(5);
var g = newGlobal('new-compartment');
g.eval("function f() {\n" +
       "    for (var i = 0; i <= N; i++)\n" +
       "        log += 'L';\n" +
       "}\n");
g.f();


The minimized version had code in it that disabled the type inference using options(), that is why this test must be run with -m -a only. The original test can't have used options() to disable TI because options() is a no-op in the unminimized driver.

Comment 1

[Brian Hackett [Laid off!]]

Chunk compilation shouldn't be performed when type inference is off (since no recompilation will be necessary).  Fixed in the latest bug 706914 patch.